Ask most internal audit or SOX programme leaders which control category worries them most, and the answer is rarely the exotic one. It's access. Not because access is technically hard to test — a well-run access review can be completed on schedule, evidenced, and closed without much drama — but because access is the one control area that never actually stops moving. Every joiner, every promotion, every offboarding, every emergency grant, every system migration reshapes the population you just finished reviewing. A finding closed against last quarter's access state says very little about this quarter's.
That mismatch shows up clearly in the newest data. KPMG's 2025 material weaknesses study — analyzing SEC filings for fiscal years ending through June 2025 — found that weaknesses tied to systems and IT general controls were among the categories that increased year over year, and that within that category the dominant theme by a wide margin was user access: inappropriate access rights, failure to timely deprovision terminated employees, and inadequate access reviews. Separately, the same study found that of the 740 companies that disclosed a material weakness at any point between 2021 and 2025, 269 of them — 36% — disclosed one in more than one year. A Baker Tilly analysis of SEC EDGAR data going back to 2020 puts the repeat-filer share even higher: over 60% of adverse internal-control assessments come from companies that have disclosed before, rising to nearly 70% in the most recent two years of that dataset.
Put those two findings together and a specific, addressable problem emerges. Access-control weaknesses are disproportionately likely to recur, and recurrence overall is trending up, not down, even as remediation programmes mature and GRC tooling improves. The gap isn't in detecting the original issue or in documenting that a fix was applied. It's in the fact that almost no organization's remediation evidence answers the one question that actually matters for a control this dynamic: did the fix survive contact with the next joiner, the next role change, the next system refresh?
See how Crest.Digital's Agentic Risk & Continuous Assurance practice turns access remediation into remediation evidence that holds — verified continuously against your existing IAM, ERP, and GRC systems.
Explore Agentic GRCThe Most Recurring Material Weakness Isn't the One You'd Expect
Revenue recognition gets more attention in material-weakness commentary, and for good reason — it remains the single largest contributor to accounting-related weaknesses in Baker Tilly's analysis of five years of SEC data. But revenue recognition issues tend to stem from technical accounting judgment applied inconsistently, which is a knowledge and process problem that, once genuinely fixed, tends to stay fixed. Access is different in kind. KPMG's breakdown of 2025 process-area weaknesses found systems-related issues climbing even as some other categories held flat or declined, and named IT general controls — specifically the management of user access — as the concentrated driver within that category. Companies weren't failing to test access. They were failing to keep a tested-and-passed access population from quietly drifting back toward the state that failed the test in the first place.
The pattern holds up outside the SEC-filer population too. Baker Tilly's separate review of SEC EDGAR data through 2024 identifies "information technology controls" as one of the recurring themes across both management-only assessments and full auditor attestations, alongside segregation-of-duties failures that are themselves frequently access problems in disguise — a user who retains a conflicting combination of entitlements is, structurally, the same failure mode as a terminated user whose account was never disabled. Whether the underlying cause is under-resourced accounting teams, IT teams stretched across rapid system change, or simply the sheer transactional volume of access events in a modern enterprise, the effect is consistent: access is the control category where "fixed" and "stays fixed" diverge most often.
This is a genuinely global pattern, not a US SEC-reporting artifact. A European manufacturer consolidating ERP instances after an acquisition, an India-based GCC managing role provisioning across a shared-services model, and a US financial institution working through a SOX 404(b) attestation are all exposed to the identical underlying dynamic — access populations that change faster than periodic review cycles can keep pace with, regardless of which framework ultimately requires the disclosure.
The Point-in-Time Remediation Trap
Most remediation evidence for an access finding looks the same, regardless of company size or industry: a screenshot or export showing the flagged accounts were disabled, a completed access-review attestation from the relevant manager, and a closure memo describing the corrective action taken. All of it is accurate. None of it is durable. It documents a state that existed on the day someone checked, not a state that has held since.
Consider how many distinct events can quietly reopen an access finding that was closed correctly. A terminated employee's account is disabled as required — and then a re-hire six months later is provisioned from the departed employee's old role template, which still carries the excess entitlement nobody removed from the template itself, only from the individual account. An over-privileged role is trimmed for the specific users flagged in the finding — and then a routine access request for a new hire in the same function is approved against the un-trimmed version of the role because the underlying role definition, not just the assignments, was never actually corrected. An emergency or "firefighter" access grant used to resolve an incident is properly time-boxed and revoked — and then used again during the next incident without the same rigor, because the emergency-access process itself, not just the one grant, was the real gap. In every case, the closure evidence was completely accurate at the moment it was captured. The control gap simply outlived the evidence.
This is precisely the distinction between fixing a symptom and fixing a control. Correcting the specific accounts an auditor happened to sample addresses the symptom. Correcting the role template, the provisioning workflow, or the emergency-access process addresses the control — and only the second one has any chance of preventing recurrence, because it changes what happens the next time a similar access event occurs rather than just what happened to the accounts already under review. The uncomfortable finding in KPMG's data is that most organizations, most of the time, are still closing findings at the symptom level, which is exactly why the same category keeps reappearing in the following year's filing.
Crest.Digital's Voice AI lets an audit or IT security lead ask exactly that in plain language and get an evidenced answer immediately — and the same durability discipline extends to vendor-side access exposure through Crest's TPRM platform.
What Durable Remediation Evidence Actually Requires
Standards and regulators have been moving toward this distinction generally, even where they haven't named access specifically. The IIA's Global Internal Audit Standards, effective since January 2025, place explicit weight on evaluating whether management's corrective actions were actually implemented and remained effective — not merely whether a plan was proposed and a status field updated. The COSO Internal Control–Integrated Framework's monitoring component calls for ongoing evaluation of control effectiveness as a distinct, coequal discipline alongside the control activities themselves — the framework doesn't treat "the control exists" and "the control is still operating" as the same question, and access is exactly where that gap tends to widen fastest. Crest.Digital has covered the broader tightening of remediation-evidence expectations elsewhere, including the PCAOB's 2026 amendments to Auditing Standard 2201 raising the bar for previously remediated areas — that discussion applies here too, and this piece narrows specifically to the access and IT general control population where the evidentiary gap is sharpest.
On the technical side, access-control guidance has long distinguished between provisioning correctly and monitoring continuously. The access control family within the NIST SP 800-53 catalog — widely referenced well beyond its original US federal context — treats account management and access review as ongoing operational controls, not one-time provisioning events, explicitly calling for periodic review of accounts for compliance with account management requirements rather than a single closure check. That's the same principle KPMG's data is surfacing from the opposite direction: the organizations avoiding repeat access findings are the ones treating access review as continuous operational discipline, not an artifact produced once to satisfy an auditor.
In practice, durable remediation evidence for an access finding needs to show three things a closure ticket alone does not: that the specific accounts flagged were corrected, that the underlying process or role definition that produced the flaw was also corrected, and that the corrected state held for a defined period afterward without the same access path reopening through a different route. The third element is the one almost no organization currently captures — and it's the one a continuously running verification layer is built specifically to produce.
An 8-Point Framework for Access-Remediation Durability
None of this requires replacing an organization's existing IAM platform, ticketing system, or GRC tool. The framework below describes a durability-verification layer that reads from those systems and reports back into them, rather than a parallel system of record.
Remediation-Scope Definition
Capture precisely what closing a given finding requires — which accounts, which role definitions, which provisioning templates — not just which accounts an auditor happened to sample.
Point-in-Time Closure Evidence Capture
Record the standard closure artifact — the deprovisioning confirmation, the completed review, the corrected role — as the verified starting baseline, not the finish line.
Continuous Post-Closure Verification
Check the remediated population against its baseline on an ongoing basis, watching specifically for the flagged access path reopening through a new hire, role change, or template reuse.
Drift Detection Against the Remediated Baseline
Distinguish routine, expected access change from drift that recreates the specific condition the finding described, reducing false alerts on ordinary joiner-mover-leaver activity.
Root-Cause Linkage, Not Just Symptom Correction
Verify that the role template, provisioning workflow, or approval process behind the finding was corrected — not only the individual accounts flagged during testing.
Cross-Entity and Cross-System Pattern Matching
Detect the same access-control gap resurfacing in a different subsidiary, business unit, or system — the cross-cycle pattern manual review, constrained by time and organizational silos, rarely catches.
Automatic Escalation on Recurrence
Route a detected reopening back into the existing ticketing and audit-evidence workflow immediately, rather than letting it wait to resurface as next year's audit finding.
Audit-Ready Durability Evidence Trail
Maintain a defensible record showing the corrected control operated effectively for a sustained period post-closure — the specific evidence standard now expected of previously remediated areas.
Points three and five carry the most weight in practice. Continuous post-closure verification is what actually distinguishes durability tracking from a standard remediation tracker, and root-cause linkage is what determines whether a given fix had any real chance of holding in the first place.
Building the Programme: A Six-Step Delivery Playbook
Crest.Digital positions this as a configurable "Risk Automation Pod" rather than a bespoke software build — a shared underlying stack of identity and system connectors, a baseline-comparison engine, a workflow and escalation layer, and an evidence repository, customized around which access findings, systems, and entities a given organization needs to verify first.
The Discover → Design → Connect → Deploy → Validate → Transfer Model
- Discover: Inventory recently closed access and IT general control findings, the systems involved, and the specific baseline each remediation was meant to establish.
- Design: Define what durable evidence looks like for each finding type, the verification window, and which drift signals trigger an automatic reopen versus a routine alert.
- Connect: Integrate with the IAM/identity platform, ERP and business-application access logs, ticketing system, and existing GRC or audit-evidence repository.
- Deploy: Run continuous drift checks against each remediated baseline, flagging reappearing access or newly provisioned accounts inheriting the original flaw.
- Validate: Run parallel testing against a sample of recently closed findings, confirming detection accuracy before escalation thresholds go live.
- Transfer or manage: Hand ongoing operation to internal audit and IT security jointly, or continue as a Crest.Digital-managed service as systems and roles evolve.
Starting with the access findings tied most directly to financial reporting risk — privileged ERP access, payment-approval roles, and journal-entry permissions — gives the validate step a clean, high-stakes population to prove the model against before extending durability tracking across the broader access estate.
Where the Agent Stops and Judgment Stays Human
A durability-verification agent is strong at exactly one thing done continuously and precisely: comparing current access state against a defined baseline and flagging when the two diverge in a way that recreates a previously closed finding. It does not decide whether a newly detected variance is an acceptable business exception, does not adjudicate a genuinely ambiguous access request, and does not replace the auditor's or IT security lead's judgment about whether a given remediation was adequate in the first place. Those calls stay with the control owner, IT security, and internal audit — the agent's role is making sure they're making that call with current, verified information rather than a closure memo that's quietly gone stale.
This durability layer is deliberately narrow, and it's meant to sit alongside — not replace — the broader remediation and access-governance work Crest.Digital has already covered. The general lifecycle for converting any finding into a tracked action plan, reviewing closure evidence, and detecting repeat-finding patterns across cycles is addressed in audit-issue remediation and follow-up; ongoing, forward-looking monitoring across an organization's entire access population — conflicting roles, dormant accounts, terminated users with live access — is addressed in access governance and SoD monitoring; and where non-human, AI-agent identities are part of the access population being remediated, that specific inventory and lifecycle challenge is addressed in AI agent identity and access governance. Durability tracking is the layer that connects a closed finding back to continuous monitoring, so a fix that quietly comes undone doesn't have to wait for the next audit cycle to be noticed. The audit-trail requirements that apply to any AI-driven control agent, covered in why AI agents need audit trails, apply here as well — and the accountability question of who signs off when an agent flags a reopened finding is addressed directly in who is accountable when a GRC agent flags a finding.
The broader point KPMG's and Baker Tilly's data makes, read together, is that remediation quality can no longer be measured by closure rate alone. A finding closed on time with a documented action plan can still be a finding that reopens within the year if the evidence behind that closure only ever proved a moment, not a duration. For access-control findings specifically — the category now showing both the highest concentration of systems-related weaknesses and among the clearest recurrence patterns in the data — that distinction is no longer a nuance. It's the difference between a control environment that looks clean on paper and one that actually holds.
Crest Perspective
Risk programmes that treat third-party governance as a compliance checkbox are consistently underprepared when a material vendor incident occurs. The programmes that withstand regulatory scrutiny are not necessarily the most technologically sophisticated — they are the ones where risk tiering is documented, escalation paths are tested before they are needed, and the board receives accurate, timely information about the organisation’s most critical vendor dependencies.
Frequently Asked Questions
Access is not a static fact you fix once — it changes every time someone joins, moves roles, leaves, or is granted temporary or emergency access, and every time a new account is provisioned from a template that may itself carry the same flawed permissions that caused the original finding. A remediation that cleans up today's access population captures a snapshot, but the underlying provisioning process, role template, or approval gap that produced the excess access in the first place often survives the fix untouched. KPMG's 2025 material weaknesses study found systems-related weaknesses concentrated overwhelmingly in IT general controls — inappropriate access rights, untimely termination of departed users, and inadequate access reviews — which is exactly the category most exposed to this dynamic. A fix that only addresses the accounts flagged in the finding, without addressing the process that keeps generating new instances of the same gap, is structurally likely to reopen.
Crest's original piece on issue remediation covers the general lifecycle of any audit or compliance finding — converting a finding into an action plan, tracking deadlines, reviewing closure evidence against what the finding required, and detecting repeat findings across cycles and business units. This article narrows to a single, specific and disproportionately recurrence-prone category — access and IT general controls — and addresses a distinct failure mode within remediation itself: evidence that is captured at a single point in time cannot show whether a control kept operating after that point, which matters more for access than for almost any other control type because access changes continuously. The two are complementary: the general remediation framework applies to any finding, and the durability layer described here applies specifically where point-in-time evidence is the weakest fit.
Crest's access governance article addresses ongoing, forward-looking monitoring of the entire access population — conflicting roles, dormant accounts, terminated employees with live access, and similar exceptions, detected continuously as they occur. This article addresses a narrower, backward-looking question: once a specific access-related finding has been remediated and formally closed, how do you prove the fix actually held, rather than simply that the flagged accounts were corrected on the day of closure. Continuous access governance is what an organization runs across its whole access population all the time; remediation durability tracking is what runs specifically against the baseline a closed finding established, to catch the moment that specific fix quietly comes undone. Deploying both together closes the loop from detection through remediation through durable verification.
A closure ticket typically documents that a corrective action was taken — an account was deprovisioned, a role was reconfigured, a review was completed — as of a specific date. Durable remediation evidence documents that the corrected state persisted for a defined period afterward: the deprovisioned account did not reappear through a later access-request workflow, the reconfigured role wasn't quietly re-broadened by a subsequent change, and no new account provisioned from the same template inherited the original flaw. Regulators and standard-setters have been moving in this direction generally — the PCAOB's 2026 amendments to Auditing Standard 2201 raised the evidentiary bar for previously remediated areas specifically because a status change and a documented plan were judged insufficient on their own. Durable evidence is what actually supports the assertion that a remediation worked, not just that it was attempted.
No. A remediation-durability agent is designed to sit on top of the identity and access management platform, ticketing system, and GRC tool an organization already runs, reading the same access and provisioning data those systems already generate rather than replacing them. What it adds is a comparison layer — continuously checking current access state against the exact baseline a closed finding established, and a workflow layer — routing a detected recurrence back into the existing ticketing and audit-trail process rather than waiting for it to resurface as a fresh finding in next year's audit or SOX testing cycle.