The state of compliance quality
Why passing audits is no longer enough
For security and compliance leaders whose programs pass every audit but still trigger fire drills. A research-backed whitepaper on why point-in-time compliance is failing and what replaces it.
Description
Most compliance programs were built to pass, not last. Organizations obtain certifications and satisfy formal requirements, yet keep hitting repeated findings, prolonged audit cycles, and growing skepticism from customers. PwC's 2025 survey found 77% of senior leadership teams say compliance complexity is hurting organizational performance. The certifications exist. The assurance doesn't.
This whitepaper names the problem: compliance theater, where the program is optimized to produce artifacts on demand rather than prove controls stay effective as systems change. It maps the compliance reality gap between point-in-time audits and continuously changing environments, backed by data from NAVEX, CUBE, SANS, Gartner, and the PCAOB, plus the Okta breach as a case study in certified companies still getting burned.
Then it introduces the fix: Compliance Quality, a framework for evaluating whether your program produces reliable evidence, sustains control effectiveness through change, and consistently closes failures. You get the four pillars that determine whether programs stabilize or collapse, and a maturity model of three compliance operating models, from documentation-centered to execution-centered, so you can locate your own program and see what the next stage requires.
Here are the insights you will walk away with
Audits assess a snapshot while cloud infrastructure, access models, and vendors change weekly. 67% of risk and compliance professionals cite lack of visibility into risks as a top concern, and 74% of organizations say implementing new regulations takes over a year.
Policies that exist but aren't operationalized, controls tested only near audit time, evidence collected retroactively, and remediation that addresses symptoms instead of systems. Only 16% of compliance teams are pursuing a truly continuous approach.
A new lens for evaluating programs: does compliance work compound or reset as the organization evolves? High-quality systems get more efficient as scope expands. Low-quality systems get more fragile, expensive, and disruptive.
Operational strength (is compliance repeatable or heroic), evidence reliability (the strongest predictor of audit friction), control durability (what happens to controls when the organization changes), and scalability (SOC 2 and ISO 27001 share 43% of evidence requirements, if your system can reuse it).
Documentation-centered, insight-centered, and execution-centered compliance, with the Compliance Quality outcomes of each. Most organizations sit between the first two, which is why effort stays high and outcomes stay unstable even as tooling improves.
Get access to the ebook now
These are the questions this eBook will answer
Compliance monitoring is the ongoing process of checking whether security and compliance controls are operating effectively, rather than assessing them only at audit time. Done continuously, it surfaces control drift early, generates evidence as a byproduct of normal operations, and is one of the strongest predictors of fewer audit findings. Programs that invest in continuous control monitoring see far fewer auditor questions and rarely have findings related to missing evidence.
Continuous compliance means controls are monitored, evidenced, and remediated as an always-on function instead of a pre-audit push. An audit evaluates controls at a specific point in time; a continuous program sustains control effectiveness between audits, where most risk actually accumulates. The test the whitepaper proposes: if compliance requires a coordinated push before every audit, your system is point-in-time, not continuous.
An effective compliance program scores well on four pillars: operational strength, evidence reliability, control durability, and scalability. In practice that means ownership is clearly defined, evidence is generated continuously and stored centrally, controls surface drift instead of failing silently, and work done for one framework reinforces the others rather than starting from zero.
SOC 2 assessments rarely fail because organizations lack security policies. They fail because controls are not consistently executed or properly documented. Common causes include pursuing Type 2 audits without sufficient readiness, weak documentation of control evidence, fragmented ownership of security processes, and gaps in core operational controls like access and change management.
Compliance theater is audit success without operational assurance: the program is optimized to produce artifacts on demand, not to prove controls remain effective as systems change. It rarely collapses immediately. It fails gradually through repeated friction, rising costs, and accumulating risk, until a triggering event, like the 2023 Okta support-system breach affecting 134 certified-and-compliant customers, makes the weakness visible.
