 hasn’t stood still. The FRC has spent the past few years consulting on reforms, then refining them into the more focused 2024 update, which has been in effect throughout 2025. The next milestone arrives on 1 January 2026, when boards will need to make a declaration on the effectiveness of material controls under Provision 29.

 isn’t the main character of this story, but it does set the backdrop. It raises expectations around evidence, clarity and consistency, and it’s already prompting organisations to revisit how their 

 operate day to day. That makes this a good moment to take stock, not only of what compliance requires, but what stronger controls can do for the business.

Because when you strip everything back, the case for investing in better controls is simple: 

they reduce risk, improve decision-making and build trust. 

And in many organisations, they also cut cost.

Here’s how to build that case in a way that resonates with stakeholders across the business.

Start with the outcomes different stakeholders care about

A single controls programme can deliver very different benefits depending on who you speak to. The strongest business cases reflect this.


Executives want confidence that the information they rely on is accurate and that risk conversations are grounded. Stronger controls support cleaner forecasting, fewer surprises and more certainty during planning cycles.


Investors increasingly expect disclosures that are specific and evidence-based. With the new Code requiring more transparency on control effectiveness from 2026, investors will be looking for clarity, not boilerplate. Strong controls reinforce trust.


The new declaration covers more than financial controls. When ESG, health and safety and ethical practices sit within a clear control framework, customers feel more confident that the organisation delivers on its commitments.


People want to know they’re part of a well-run organisation. Clear controls help build a culture of accountability and reduce frustration in process-heavy areas.

 That might be a recurring operational error, slow remediation cycles or issues in ESG reporting. These hotspots help you show the business where controls improvements make an immediate difference.

Where automation helps (and where it doesn’t)

Automation is becoming an essential part of how organisations 

 It reduces manual checks, lowers error rates and provides more consistent evidence throughout the year. This is useful for the new Code’s expectations but is even more useful for everyday business.

But automation isn’t a magic wand. It works best when the underlying process is clear. If a process already causes confusion or rework, automating it only amplifies the problem. 

A better approach is to start with a pilot:

Focusing on the first line is key. People closest to the process can tell you what needs improving and what information they need to work more effectively. When automation helps them, evidence quality improves without extra effort.

Build a roadmap that avoids common blockers

Internal controls touch multiple teams and systems,

 and sometimes third parties too. Without a structured plan, programmes lose momentum quickly.

A roadmap with four early decisions makes all the difference:


Agree what counts as a material control. This should reflect risks, regulatory duties and anything that could affect key reporting. Provision 29 specifically requires boards to cover financial, operational, reporting and compliance controls.


Set expectations for what “good evidence” looks like. This includes testing frequency, documentation standards, thresholds for exceptions and how remediation is tracked.


Clarify how first, second and third line work together. Assurance should be coordinated rather than duplicated, especially as organisations prepare for the more structured disclosure requirements in 2026.


Align data, systems, processes and owners. Third-party providers need to be included early where they support key controls.

Most delays come from not agreeing these points upfront. Once the basics are settled, teams can focus on testing, fixing gaps and building confidence in the framework.

Start early, focus on value and support people through change

Although the declaration applies to 2026 year ends, organisations need a full year’s worth of monitoring and evidence behind it. Starting now means fewer surprises and more time to test, remediate and refine.

Different stakeholders move at different speeds. Some need more context, others want reassurance that the work will help them, not add to their workload. Tailoring the message to each group helps maintain momentum.

The lesson I see again and again is simple:

 Keep the needs of first-line managers front and centre.

When ownership is clear and processes run smoothly, the evidence is stronger, the board can form its view with confidence and the whole organisation benefits from fewer operational issues.

Strengthening internal controls is not only about meeting the Code. It’s about creating a clearer, more predictable and more resilient business.

If you’re building your approach for 2026:

 offers a simpler way to coordinate testing, evidence and remediation, so your controls framework stays clear and consistent throughout the year.

Maximising ROI: The business case for improving internal controls

For SaaS companies pursuing enterprise customers, security certifications have become table stakes. But managing multiple frameworks — SOC 2, 

 and beyond — creates operational complexity that drains resources and delays revenue.

A cloud controls framework solves this challenge by establishing unified security controls that simultaneously satisfy multiple certification requirements, transforming compliance from a cost center into a competitive advantage.

The principle is straightforward: Build controls once, certify many times. When organizations design controls to satisfy the common requirements across frameworks, they eliminate duplicate documentation, consolidate evidence collection and streamline audit preparation.

Instead of treating each certification as a separate project, a unified framework captures the significant overlap between standards, enabling faster time-to-certification and sustainable compliance that scales with business growth.

This article covers everything you need to know about implementing a cloud controls framework for certification efficiency:

What a cloud controls framework is and how it differs from individual security standards

The business case for unified controls: cost savings, faster certifications and reduced audit fatigue

A step-by-step implementation roadmap for building your framework

How AI-powered compliance platforms operationalize cloud controls at scale

Frequently asked questions about cloud controls frameworks

 is a structured set of security policies, procedures and technical safeguards designed to protect data and systems in cloud environments while satisfying the requirements of multiple regulatory and certification standards.

Rather than implementing separate controls for each certification, organizations design unified controls that map to common requirements across frameworks.

When properly implemented, a single access control policy can simultaneously satisfy requirements under SOC 2, ISO 27001, 

 and HIPAA, eliminating redundant work while strengthening the overall security posture.

How cloud controls frameworks differ from security standards

Security standards like SOC 2 or ISO 27001 define what organizations must achieve. A cloud controls framework defines how organizations implement and demonstrate those requirements efficiently.

The framework serves as the operational layer that translates multiple standards into practical, testable controls.

ISO 27001 requires organizations to manage access to information assets

SOC 2 requires logical and physical access controls

NIST CSF requires identity management and access control

 consolidates these overlapping requirements into a single access management control with evidence collection that satisfies all three standards.

Common controls framework vs. cloud controls framework

While closely related, these terms serve different contexts. A common controls framework (CCF) is the broader concept: a unified approach to managing controls across any regulatory requirements.

A cloud controls framework applies this approach specifically to cloud computing environments, addressing the unique security considerations of cloud infrastructure, shared responsibility models and cloud-native services.

For SaaS companies, the cloud controls framework incorporates both the CCF methodology and cloud-specific requirements like data residency, encryption in transit and at rest, and cloud provider security configurations.

The business case for unified cloud controls

Building a cloud controls framework requires upfront investment. The return comes through accelerated certifications, reduced operational costs and strategic business benefits.

Organizations pursuing certifications separately face compounding timelines:

SOC 2 Type II usually requires 6-12 months of observation

ISO 27001 implementation typically takes 3-12 months

, PCI DSS or FedRAMP, and the cumulative timeline extends well beyond what growth-stage companies can afford.

A unified framework compresses these timelines by enabling parallel certification efforts. Controls designed for multiple frameworks simultaneously satisfy overlapping requirements. The same access review process that demonstrates SOC 2 compliance also supports ISO 27001 and HIPAA requirements.

Every certification requires evidence collection, stakeholder interviews and auditor engagement. Separate certification programs mean separate audit cycles, multiplying the burden on already stretched compliance and security teams.

A common controls framework consolidates evidence collection. When a single control satisfies multiple requirements, organizations collect evidence once and apply it across frameworks. This reduces not only the direct audit burden but also the operational disruption that comes from constant auditor engagement.

Revenue acceleration through faster security responses

Enterprise sales cycles increasingly depend on security questionnaire response speed. Buyers submit detailed security questionnaires before procurement decisions and slow responses can delay deals or lose them entirely.

Organizations with mature cloud controls frameworks can respond faster because their 

 is centralized and current. Rather than scrambling to gather evidence for each questionnaire, teams access a unified repository that maps controls to common questionnaire requirements.

Discover how unified controls management accelerates SOC 2, ISO 27001 and FedRAMP certifications while reducing audit fatigue.

Build certification-ready controls

Implementing a cloud controls framework: A six-step roadmap

Building an effective framework requires systematic planning and execution. The following roadmap guides organizations from initial assessment through continuous monitoring.

Start by mapping your regulatory landscape. Consider:

 Which certifications do customers currently request? What frameworks do contracts mandate?

 Which certifications will you need as you expand into new markets or customer segments? 

 differ from enterprise-scale programs, but building with growth in mind prevents costly rework.

 Healthcare organizations need HIPAA and potentially HITRUST. Financial services require SOX and potentially PCI DSS. Government contractors need NIST 800-171 or FedRAMP.

Then, document each framework's requirements and begin identifying overlaps.

Step 2: Map control requirements across frameworks

With frameworks identified, create a comprehensive control mapping. For each control domain (access management, data protection, incident response, etc.), document:

Specific requirements from each applicable framework

Common requirements that appear across multiple frameworks

Unique requirements specific to individual frameworks

Evidence requirements for demonstrating compliance

This mapping becomes the foundation for your unified control design. Pay particular attention to terminology differences: what SOC 2 calls "logical access controls" may overlap significantly with ISO 27001's "access control policy" requirements.

Step 3: Assess current state and identify gaps

 against your requirements map. Many organizations already have controls in place that partially satisfy framework requirements but lack formal documentation or evidence collection.

 Which requirements do current controls satisfy? Is documentation sufficient for audit purposes?

 Which requirements are partially addressed? What gaps exist?

 Which requirements have no existing controls?

Prioritize gaps based on risk and certification timeline. Controls that satisfy multiple frameworks or address significant security risks warrant immediate attention.

Step 4: Design and implement unified controls

Design controls that satisfy the most stringent applicable requirement. When SOC 2 requires access reviews every 90 days and ISO 27001 requires annual reviews, design for 90-day reviews. The more stringent control satisfies both frameworks.

 systematically, beginning with foundational controls (access management, change management, incident response) before addressing specialized requirements.

Step 5: Establish evidence collection processes

Sustainable compliance requires automated evidence collection. Manual evidence gathering is labor-intensive, error-prone and creates audit preparation crises.

Define evidence requirements for each control:

 Access logs, configuration reports, vulnerability scans

 Approved change requests, incident tickets, meeting minutes

 Policy acknowledgments, training completions, management certifications

Integrate evidence collection into operational workflows. The best evidence is a byproduct of normal operations, not a separate compliance activity.

Point-in-time audits provide limited assurance. By the time an annual audit identifies a control failure, the gap may have existed for months — creating both security risk and remediation burden. 

 shifts compliance from reactive to proactive by identifying issues as they occur rather than during audit preparation.

Effective monitoring programs combine automated control testing with real-time alerting and dashboard visibility across frameworks. Rather than scrambling to compile evidence before audits, teams maintain audit-ready documentation as a byproduct of normal operations.

Trend analysis surfaces emerging risks before they escalate, while automated testing validates that controls operate as designed without manual intervention. The result is sustainable compliance that improves security posture while reducing the operational burden on compliance teams.

How AI transforms cloud controls management

Traditional approaches to multi-framework compliance can't keep pace with expanding certification requirements and continuous monitoring expectations. By the time teams compile evidence for one audit, requirements may have shifted for another.

Manual spreadsheet-based processes create bottlenecks that delay certifications and drain resources from strategic initiatives.

AI-powered platforms are transforming this reality by enabling unified control management, automated evidence collection and real-time visibility into compliance status across frameworks.

For organizations achieving their first certifications or expanding into new frameworks, 

 provides centralized management across 75+ frameworks, including SOC 2, ISO 27001, NIST, FedRAMP and HIPAA.

The platform's Common Controls Framework capability enables teams to design controls once and automatically map them to multiple certification requirements, eliminating the duplicate documentation that historically consumes compliance team resources.

For companies expanding into public sector markets, FedRAMP-authorized options enable compliance without platform migration, including DoD IL-5 authorization for defense-related opportunities.

And for organizations that require integrated policy governance alongside IT compliance, 

 streamlines policy creation, approval and attestation workflows. Automated employee acknowledgment tracking creates defensible records demonstrating that personnel understand their compliance obligations.

Version control maintains comprehensive audit trails showing how policies evolved over time, essential for demonstrating governance maturity during customer audits and investor due diligence.

Whether you're pursuing your first SOC 2 certification or managing multi-framework compliance across global operations, the objective is to build a compliance function that accelerates revenue rather than constraining it.

Ready to simplify multi-framework compliance? 

 to see how Diligent IT Compliance helps organizations achieve certification faster while reducing audit fatigue.

Cloud controls framework: Build once, certify many times

This article originally appeared in our December 18th edition of the Diligent Minute Newsletter. For more insights like these, delivered straight to your inbox, subscribe 

As we close out 2025, I’ve been reflecting on what this year taught us and the word that comes to mind is “unprecedented.” Insights from the Diligent Institute’s research show how directors navigated multiple unprecedented challenges – often simultaneously – while also driving major change. The lessons we learned this year aren’t just a look back. They can be a compass pointing to the directional shifts boards will need to embrace as governance moves into a faster, more AI-enabled era.

Five governance shifts boards must prepare for in 2026

What will change: Boards will move beyond passive reporting and lean into more 

 Predictive analytics and scenario planning will become part of everyday conversations, helping directors navigate volatility before it hits.


Why? Director confidence hit historic lows in 2025. Our 

 conducted in partnership with Corporate Board Member, landed at just 4.8 out of 10, among the lowest since the pandemic. That’s a wake-up call for faster, smarter decision-making. If you’re curious whether sentiment is shifting, our Q4 results will be live by the time this issue hits your inbox. Check them out to see if optimism is making a comeback.

What will change: Dashboards won’t just summarize risks. They’ll surface them within hours, and crisis protocols will kick in during the first 72. AI-powered assurance will scan massive datasets to catch anomalies as they happen, and directors will be able to ask complex questions in plain language and get instant answers. Oversight will move from reacting after the fact to staying ahead of the curve, a fundamental change in risk management.

 7.9 out of 10. Quarterly updates aren’t enough anymore. Boards need early-warning systems and integrated intelligence to keep pace.

3) AI governance moves to the top of the agenda

What will change: Agentic AI is moving fast, from assisting to acting. Boards will need to build AI literacy, test for bias and keep humans in the loop to manage less visible risks.

Why: Two-thirds of directors used AI tools in 2025, but 

, 57% of respondents said their organizations had deployed AI in one or more areas of the business, but only 36% had audited usage.As AI deployment climbs higher on the priority list for 2026, closing this governance gap is critical.

4) Integration becomes a growth essential

What will change: M&A ambitions will stall without tech integration. Boards that prioritize scalable platforms will unlock faster, cleaner transactions and reduce risk during rapid growth periods as integration readiness becomes a board-level KPI.

 conducted in partnership with Wilson Sonsini and NetSuite, found only 4% of organizations had fully integrated GRC and financial systems.

What will change: Board agendas will shift toward forward-looking conversations powered by predictive analytics and cultural insights. Directors will widen their lens beyond financials to include culture and workforce resilience, using anonymized data to spot risks before they surface.

Why: The ability to anticipate, not just react, will define effective governance in 2026. Boards that lean on AI-driven scenario modeling and continuous feedback loops will stay aligned with fast-changing realities.

Turning 2025 board lessons into a 2026 action plan

2026 will reward boards that act, not just react. That means pairing human judgment with AI-driven foresight, embedding continuous assurance and integrating systems for scalability. Governance is moving from static to dynamic – and the boards that thrive will be ready to keep pace.

Check out the full blog on trends shaping governance in 2026.

From risk to strategy: The governance agenda for 2026 

Boardroom confidence surges in final quarter despite tepid 2026 expectations 

After three quarters at a five-year low, director confidence jumped 23 percent in December—yet the outlook for 2026 remains muted. One director's advice: 'Defend and survive.'

America's corporate directors ended 2025 on an unexpectedly optimistic note.

After languishing at a five-year low for three consecutive quarters, the Director Confidence Index—a quarterly poll conducted by Corporate Board Member and Diligent Institute among U.S. public company board members on their sentiment for business—surged 23 percent in December, climbing from 4.9 out of 10 to 6.0 and finally breaking into "Good" territory. 

A better understanding of how tariffs are impacting businesses and the economy, lower interest rates and increased CapEx spending are the most common factors directors shared to explain this rebound. 

“[There’s] an expectation that companies will be able to work through any tariff impacts without significantly raising prices,” explained one director participating in the poll.

It's a remarkable turnaround for a year that tested boardroom resolve. 

Yet even with the late rally, 2025's average confidence level landed at just 5 out of 10—well below 2024's 6.2 average and significantly short of the 6.9 that directors had predicted this time last year.

The 105 directors surveyed December 6-11 overwhelmingly point to one issue that slowed down business this year: tariffs. 

Three quarters cited it as a top contributor to lower-than-expected business conditions, well ahead of any other factor, noting that standard playbooks don’t work when the environment keeps changing.

“No matter how much you try to prepare for the unexpected, you can never truly assess all outcomes,” said one director on the board of a publicly traded tech company. “We did not see the substantial impact the ever-changing tariff environment (much of which was likely unconstitutional) would have on our customers CapEx spending plans.”

“I have never experienced what we are seeing in our industry in my 30+ years,” said one director at a Nasdaq-traded life sciences company. “Pharma/biotech has always been recession-proof and has not been impacted by which party was in power at the time.”

Despite December's surge, directors aren't banking on momentum carrying into the new year. Their forecast for business conditions by this time in 2026 sits at 6.0—essentially flat from today's level.

This is an interesting delta when compared to CEO sentiment. When polled by sister publication Chief Executive the first week of December, 

CEOs said they forecast conditions will improve by

 in 2026, to land at 6.4 out of 10 next December.

Overall, 44 percent of CEOs are optimistic that conditions will improve, vs. 32 percent of board members.

Among those directors who are optimistic, we observe a strong AI focus in their responses, far outpacing macro fears that are atop the list of concerns among directors who expect conditions to deteriorate in 2026. As for those neutral directors, the uncertainty they expect to continue in the year ahead rivals inflation as a key theme.

To navigate 2026 successfully, directors are prioritizing adaptability, deeper engagement and faster learning, recognizing that compounding risks demand boards connect dots more quickly than ever. "Work hard and smart, keep expenses tight, and survive until a rebound comes around," advised one director.

“Defend and survive,” concluded another.

The Director Confidence Index five years later

To mark our fifth year of running the Director Confidence Index, we asked respondents this quarter to reflect on how their roles had shifted since we first fielded this survey at the end of 2020. Directors say they are spending far more time on risk in a “more complex and faster‑moving” environment—cybersecurity, AI, geopolitical shocks, supply‑chain integrity and policy volatility are now routine board agenda items, not edge cases. 

Many describe a shift from “managing the present” to “understanding and planning for the future,” with scenario planning and strategic resilience now core to the role. Several also point to rising scrutiny from activists and a broader investor base, which has widened the mandate from overseeing financial performance to stewarding culture, human capital and corporate character.

Directors repeatedly flag the steep learning curve this entails. In their open‑ended comments, they emphasize the need to be more tech‑savvy on AI and cyber, more fluent in geopolitics and regulation, and more intentional about ongoing education just to remain effective in the boardroom. Committees are “very busy,” topics are broader, and some directors note a clear move away from informal business development toward disciplined governance, succession planning and risk oversight. 

While a minority insist the formal role has not changed, the weight of the written responses is unmistakable: being a director today is more time‑intensive, strategically demanding and consequential than it was in 2020, and possibly than it has ever been. 

Diligent

Blog

Maximising ROI: The business case for improving internal controls

Cloud controls framework: Build once, certify many times

Your Data Matters