Services / Continuous Operations
Business Process Monitoring
Continuous proof that you actually do what your policies say you do.
The problem
Your policy says access is reviewed quarterly. It has not been reviewed since the audit. Your policy says every production change is approved; roughly a third of them are merged by the author. None of this is malice. It is a company that got busy. You will find out about it in the week of the next audit, when it is expensive, instead of in the week it happened, when it was free.
The method.
Turn each policy commitment into a testable assertion
A policy is a set of claims about behaviour, and each claim has an observable signature. "Access is reviewed quarterly" becomes: a review campaign exists, it covers the systems in scope, it was completed within the quarter, and the revocations it produced were executed. "Changes are approved" becomes: every merge to the production branch has an approval from someone other than the author. We do this for every load-bearing control in the ISMS.
Connect to the systems where the work leaves a trace
Read-only integrations with the identity provider, source control and CI/CD, the ticketing system, the HR system, the cloud control plane, the MDM and the endpoint tooling. We instrument the systems of record rather than asking people to self-report, because self-reporting is the thing that drifts first.
Test each assertion on its own cadence
Continuous checks for things that happen daily: change approval, joiner provisioning, leaver revocation within SLA, backup job success, security training assignment on hire. Periodic checks for things with a defined window: quarterly access review completed, annual policy review recorded, vendor re-assessment performed, restore test executed. The check runs whether or not anyone is thinking about the audit.
Report the drift, with the evidence attached
A finding is not "access review overdue". It is: the Q2 access review closed on the IdP and code repositories but not on the production database; three leavers from May still hold roles; the last completed campaign produced 11 revoke decisions of which 4 were never executed. Named systems, named records, and the specific control and clause the gap breaches.
Route findings to an owner with a deadline
Each finding goes to the person who can close it, in the tracker they already use, with the control reference attached. Ageing is tracked. A control that is repeatedly missed is escalated as a process failure rather than re-raised monthly, because the fix for the third occurrence is never "remind them again".
Keep the evidence for the auditor as a by-product
Every check and every closure is retained with a timestamp. When the surveillance audit or the Type II window arrives, the evidence of continuous operation already exists, and it is stronger evidence than anything assembled in the fortnight before an audit.
What is business process monitoring in compliance?
Business process monitoring is the continuous verification that an organisation performs the processes its own policies commit it to. Each policy commitment (quarterly access reviews, approval of every production change, revocation of leaver access within a day, tested backups) is converted into a testable assertion and checked against the systems of record on an ongoing basis, rather than being confirmed once a year during an audit.
How is this different from a compliance dashboard like a GRC tool?
Most compliance tooling checks technical configuration: is encryption on, is MFA enabled. Business process monitoring checks organisational behaviour: did the quarterly review happen, were the revocations it produced executed, was the change approved by someone other than its author. Configuration drift is the smaller problem. Process drift is the one that causes audit findings, and it is invisible to a configuration scanner.
What is compliance drift?
Compliance drift is the widening gap between what an organisation documented at certification and what it does in practice. It is almost never deliberate: a control owner leaves, a process gets skipped in a busy quarter, a new system lands outside the scope of an existing procedure. Because certification is point-in-time, drift accumulates unseen until the next audit, which is why continuous monitoring of process, not just configuration, is what keeps a certificate honest.