From Samples to Data Streams: Auditing Organisations That Change a Thousand Times a Day

This is the extended version of my talk at IIA Luxembourg & ISACA Luxembourg Chapter. With more time, I built it around a story. A real one, anonymised. Let’s call the organisation ACME.

ACME had a problem with change management. Every year the audit found issues with segregation of duties: who reviews a change, who approves it, who deploys it. And every year ACME worked hard to fix them. Then the next audit came, and the issues were back. It felt like it would never end.

The thing is, between two audits everything at ACME changed. A thousand deployments a day. Pipelines and tools reconfigured hundreds of times. Each team approving changes in its own way. The evidence for a single change spread across several systems.

So why did the findings keep coming back? In the talk we follow ACME through four challenges. In each one, ACME stops relying on samples and looks at the SDLC as a data problem. That’s how it finds what the audits had missed. A risk hiding in one new service. An approval rule lost in a pipeline migration. A workflow where people could approve their own changes. Approvals that arrived after the change was already in production.

For engineering teams, looking at the data makes expectations explicit. Teams know what is expected, and can monitor it themselves as things change. Issues get fixed when they happen, long before the next audit. And the weeks before an audit get a lot calmer.

At the end, I share what this means if you own or prepare audits, and five questions you can ask your engineering team today.