A point-in-time audit tests a sample of evidence from one period, and its report is relied on until the next audit. A control that fails outside the sample, or after the period closes, is not in the report. Continuous testing replaces the sample by testing each control against live data on a set frequency and keeping every result as evidence.
Most risk teams are asked to prove continuous oversight with the staff they had for annual reviews. An audit cycle built for that pace leaves 3 gaps.
What an audit actually tests
An audit does not examine every instance of a control. The PCAOB auditing standard AS 2315, Audit Sampling, defines sampling as applying an audit procedure to less than 100% of the items in an account balance or class of transactions, in order to evaluate a characteristic of the whole. The same standard names the cost of that choice. Sampling risk is the possibility that the conclusion drawn from a sample differs from the one the auditor would reach by applying the same test to every item.
The standard is written in the language of financial audits, and the same logic applies to any audit that tests a sample of control activity. Sampling is a sound method for the question an audit asks, which is whether a control operated over a period. The question a risk team asks every day is whether the control is working now.
Gap 1. The sampling window
An auditor selects items from a defined period, such as a set of change tickets, new user accounts or access reviews. If a control was switched off for 3 weeks and none of the selected items fell inside those weeks, the sample cannot show it.
The report is accurate about what it tested. The gap is in what it could not see.
Gap 2. Drift between audits
Controls keep changing after the auditor leaves. A cloud storage bucket is made public for a test and left that way. An administrator account is created outside the joiner process. A service account is exempted from multifactor authentication during a migration and never put back.
Each change is ordinary, and each one can turn a control that passed into one that fails. Drift is the distance between the state a control was tested in and the state it is in now. Nothing in an annual audit cycle is designed to notice it until the next audit, so the longer the interval between tests, the more drift a clean report can carry.
Gap 3. Evidence that ages
A screenshot shows a setting on the day it was taken. An exported user list is correct at the minute of the export. A questionnaire answer describes the program as the person answering understood it on the day they answered.
Each of these is read long after it was produced, by an auditor, a customer, a regulator or a board. The evidence was true once, and its date is the only part of it that stays certain. A reader who checks the date before reading the content reads it correctly.
What replaces the sample: continuous testing
Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected. Continuous Control Monitoring (CCM) monitors conditions, evidence and signals associated with controls. CCM is a capability within CCA, and it supplies the evidence that each test reads.
A control assured this way has 4 parts: a source of evidence, a test, a frequency and an owner. The source is the tool that enforces the control, such as the identity provider for multifactor authentication. The test is a condition that passes or fails.
Each of the 3 gaps closes in a specific way. The sample becomes the population, because the test reads every account or configuration the tool reports. Drift is found on the next test run instead of at the next audit. Every result carries the date and time of the test that produced it, so anyone reading it can see how old the evidence is.
A failed test does not wait to be filed as a finding. It raises a risk with an owner and a deadline, and the control is tested again when the owner marks the work done. How to tell this kind of monitoring apart from files uploaded on a schedule, and when it is worth the cost, is covered in Is Continuous Control Monitoring Worth It, or Just a New Name for Compliance Automation?.
This is the model DigitalXForce runs in its AI-Powered Risk Management and Automated GRC module, which tests each control against live data through 250+ technology integrations and maps the result once to 50+ compliance frameworks.
What continuous testing does not change
It does not remove the auditor. The audit opinion is still the auditor’s, and continuous testing changes what the auditor receives: evidence with a timestamp and a source, in place of a screenshot with an explanation.
Some controls cannot be read from any tool, such as a background check, a board review or a physical security walkthrough. A person still attests to those. The attestation is recorded with its date and owner beside the tested controls, so the auditor reads a single evidence trail.
Where DigitalXForce is not the answer
A company preparing its first SOC 2 report with a small cloud stack does not need continuous testing across dozens of tools. A compliance automation tool built for that job, such as Vanta or Drata, fits it better, and the trade-offs are set out in DigitalXForce vs Drata. A team without a working identity provider or central logging should fix those first, because continuous testing reads from them.
Continuous testing fits an organization that reports against several frameworks, runs many security and enterprise tools, and answers to a board or a regulator between audits.
How to start
- List the controls that appear in the most frameworks you report against. Multifactor authentication, privileged access, encryption at rest, logging, patching, backup, access reviews, change management, vendor due diligence and incident response cover most of the overlap.
- Name the tool that enforces each control and connect it. A control with no tool behind it is attested for now and flagged for later.
- Set the test, the frequency and the owner for each control.
- Run the tests and compare the results with your last audit report. The difference between the two is the drift the audit could not see.
- Fix what the tests find in the order of risk, and leave the audit calendar to set only the date of the next opinion.
Questions about point-in-time audits
Is a clean audit report proof that controls work today?
No. A clean report is evidence that the controls the auditor tested operated as described during the period the audit covered. It does not describe changes made after that period closed. For the current state, you need a test run against the live system.
What is sampling risk?
PCAOB AS 2315 describes sampling risk as the possibility that a conclusion drawn from a sample differs from the one the auditor would reach by testing every item. Testing every item on a set frequency removes it for the controls a tool can read.
What is control drift?
Control drift is a change in a control’s state after it was last tested. A setting is changed, an account is added or a service stops reporting, and a control that passed now fails. Drift is found by testing again, which is why the frequency of a test matters as much as its design.
Does continuous testing replace the annual audit?
No. A certification or an attestation report still needs an independent auditor’s opinion. Continuous testing gives the auditor dated evidence from the tools, so the audit becomes a review of a record instead of a collection exercise.
How often should a control be tested?
Test it as often as the system behind it can change in a way that matters. An identity provider setting can change on any day, so it is tested far more often than a written policy that is reviewed once a year. The frequency is set for each control and agreed with its owner.
Which controls should be tested continuously first?
Start with the controls that a tool can read and that appear in the most frameworks you report against, such as multifactor authentication, privileged access, encryption at rest and logging. A single test of each then serves every framework that requires it.
Sources
The definition of audit sampling and of sampling risk is taken from PCAOB AS 2315: Audit Sampling, paragraphs .01 and .10, at https://pcaobus.org/oversight/standards/auditing-standards/details/AS2315, read on 24 September 2026.
What this looks like in practice
Reading about continuous evidence is one thing. Watching a control get tested against live data from your own stack is another. A 30 minute walkthrough on your frameworks shows the difference.
