Continuous compliance monitoring: why annual audits are no longer enough

A traditional audit is a set of samples. The auditor picks dates and records, tests them, and forms an opinion. That made sense when systems changed slowly. In a cloud environment where infrastructure is created by code and permissions change daily, a sample tells you about the days that were sampled.

If your controls are checked only when an auditor is coming, you're reporting on a company that existed for a few days a year. Continuous monitoring is now the minimum for any company running on cloud infrastructure that sells to enterprises.

I've prepared companies for SOC 2 Type II audits, and the exceptions that hurt were almost never design failures. They were controls that worked when set up and drifted quietly afterwards.

What drift looks like

A storage bucket made public to share a file with a prospect and never locked again. An engineer given admin rights during an incident at 1 AM, still an admin in June. MFA disabled on a service account because an integration kept breaking. A new laptop that never got disk encryption because the device management enrolment failed silently.

Most engineers have granted someone access "just for tonight" and then gone to sleep. That's drift, and it starts with a kind decision.

What the numbers say

RegScale's 2026 State of Continuous Controls Monitoring report found that 95% of organisations have some automation in GRC, but only 4% have it end to end. Only 28% monitor security controls continuously in real time, while 72% still rely on periodic assessments. More than half said they assign the equivalent of a full time employee to evidence collection.

That last number tells you where the time goes. People are manually proving, after the fact, what a system could have recorded as it happened.

Evidence, not alerts

A lot of tools sold as continuous compliance are really alerting. They tell you when something is wrong. That helps, but it gives an auditor a list of failures and an implicit promise that everything else was fine.

The better model is evidence based. Every check produces a record with a timestamp, the system it looked at, the scope it covered and the result, whether pass or fail. Over a year that becomes a continuous history of each control, which is what a Type II auditor actually wants to see.

A dashboard that only turns red is a smoke alarm with no memory.

What to monitor first

Identity: MFA coverage, admin accounts, joiners and leavers against HR records. Cloud configuration: public storage, open security groups, logging enabled, encryption at rest. Endpoints: encryption, screen lock, OS updates. Vendors: whether anyone new has started processing customer data. Start there before you try to automate everything.

What still needs a person

Risk decisions. Exceptions. Policy. Whether a vendor is acceptable. Whether an incident is reportable under DPDP or CERT-In. Monitoring should feed these decisions, never make them.

This is the balance we aim for in Steppe: connected systems are read directly, every finding carries a date, the judgement calls go to a named person, and you can trigger a fresh evaluation whenever something changes. Most serious platforms in this category, Vanta and Drata included, now run continuous checks. The difference worth testing is what's left behind when the check passes.

Compliance is a property of every day your systems run, so measure it every day.