Case study 5 / Monitoring demo
Continuous controls monitoring demo (simulated replay)
Simulated. This is a replay of a simulated 31-day feed about a fictional company. No real system, person or account is monitored, and no alert is ever sent. It shows how the audit tests of case study 1 could run every day instead of once.
An audit looks at one moment. This demo re-runs three of the audit's tests every day, tracks each exception until it is fixed, and escalates when the clock runs out.
The numbers
31
days monitored (simulated)
35
feed events
11
exceptions detected
6
resolved
5
still open at the end
29
simulated alerts
6
SLA breaches
4.3
mean business days to resolve
Why you can trust the rules: they reconcile with the audit
Run on the original 2026-07-15 extract, the daily rules flag exactly the records the Project 1 audit flagged. A test fails the build if they ever differ.
| Rule | Audit test re-performed | Records flagged by the monitor | Records flagged by the audit | Result |
|---|---|---|---|---|
| M-01 | T-02 (NS-IAM-02), rules R-IAM-01 and R-IAM-02 | A-0132, A-0171, A-0218, A-0329 | A-0132, A-0171, A-0218, A-0329 | Match |
| M-02 | T-08 (NS-PAM-01), rule R-IAM-04 | A-0170, A-0388 | A-0170, A-0388 | Match |
| M-03 | T-07 (NS-IAM-07), rule R-IAM-05 | A-0242, A-0390, A-0399 | A-0242, A-0390, A-0399 | Match |
The monitoring policy (fictional)
| Rule | What it checks | Severity | Owner | Escalation on SLA breach | Then |
|---|---|---|---|---|---|
| M-01 | Account belongs to a terminated employee, is still Active, and either more than 2 business days have passed since termination or the account has logged in after termination. | High (Critical if the account logged in after termination) | IT Security Manager | Head of IT Operations | Chief Risk Officer |
| M-02 | Account has privilege level Admin and is missing the approval ticket, approver or approval date. | High | Head of Platform Engineering | Head of IT Operations | Chief Risk Officer |
| M-03 | Human account with MFA disabled. | Medium | IT Security Manager | Head of IT Operations | Chief Risk Officer |
Open exceptions over time
Data table for this chart
| Date | M-01 | M-02 | M-03 |
|---|---|---|---|
| 2026-10-01 | 1 | 2 | 0 |
| 2026-10-02 | 1 | 2 | 0 |
| 2026-10-03 | 1 | 2 | 0 |
| 2026-10-04 | 1 | 2 | 0 |
| 2026-10-05 | 1 | 2 | 0 |
| 2026-10-06 | 1 | 2 | 0 |
| 2026-10-07 | 1 | 2 | 0 |
| 2026-10-08 | 1 | 2 | 0 |
| 2026-10-09 | 0 | 2 | 0 |
| 2026-10-10 | 0 | 2 | 0 |
| 2026-10-11 | 0 | 2 | 0 |
| 2026-10-12 | 1 | 2 | 0 |
| 2026-10-13 | 1 | 3 | 1 |
| 2026-10-14 | 1 | 2 | 1 |
| 2026-10-15 | 1 | 2 | 1 |
| 2026-10-16 | 0 | 1 | 1 |
| 2026-10-17 | 0 | 1 | 1 |
| 2026-10-18 | 0 | 1 | 1 |
| 2026-10-19 | 1 | 1 | 0 |
| 2026-10-20 | 1 | 2 | 0 |
| 2026-10-21 | 1 | 2 | 0 |
| 2026-10-22 | 1 | 2 | 0 |
| 2026-10-23 | 1 | 2 | 1 |
| 2026-10-24 | 1 | 2 | 1 |
| 2026-10-25 | 1 | 2 | 1 |
| 2026-10-26 | 1 | 2 | 1 |
| 2026-10-27 | 2 | 2 | 1 |
| 2026-10-28 | 2 | 2 | 1 |
| 2026-10-29 | 2 | 2 | 1 |
| 2026-10-30 | 2 | 2 | 1 |
| 2026-10-31 | 2 | 2 | 1 |
Health by day
| Rule | 2026-10-01 | 2026-10-02 | 2026-10-03 | 2026-10-04 | 2026-10-05 | 2026-10-06 | 2026-10-07 | 2026-10-08 | 2026-10-09 | 2026-10-10 | 2026-10-11 | 2026-10-12 | 2026-10-13 | 2026-10-14 | 2026-10-15 | 2026-10-16 | 2026-10-17 | 2026-10-18 | 2026-10-19 | 2026-10-20 | 2026-10-21 | 2026-10-22 | 2026-10-23 | 2026-10-24 | 2026-10-25 | 2026-10-26 | 2026-10-27 | 2026-10-28 | 2026-10-29 | 2026-10-30 | 2026-10-31 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| M-01 | Green | Green | Green | Green | Green | Green | Amber | Amber | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Amber | Amber | Amber | Amber | Red | Red | Red | Red | Red |
| M-02 | Green | Green | Green | Green | Green | Green | Amber | Amber | Amber | Amber | Amber | Red | Red | Red | Red | Red | Red | Red | Red | Red | Red | Red | Red | Red | Red | Red | Red | Red | Red | Red | Red |
| M-03 | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green | Green |
Two stories from the replay
The critical one: M-01 A-0237
SYS-04 Reviewer still Active; employee E0070 terminated 2026-10-23; last login 2026-10-27 is AFTER termination. Under the fictional appetite statement, a confirmed login after termination goes straight to the Chief Risk Officer.
- 2026-10-27: New exception, to the IT Security Manager (simulated). Leaver account still active past the deadline: SYS-04 Reviewer still Active; employee E0070 terminated 2026-10-23; last login 2026-10-27 is AFTER termination
- 2026-10-27: Critical: immediate escalation, to the Chief Risk Officer (simulated). Post-termination login detected: SYS-04 Reviewer still Active; employee E0070 terminated 2026-10-23; last login 2026-10-27 is AFTER termination
- 2026-10-29: SLA breach: escalated, to the Head of IT Operations (simulated). Open 2 business days (SLA 1): SYS-04 Reviewer still Active; employee E0070 terminated 2026-10-23; last login 2026-10-27 is AFTER termination
- 2026-10-30: Second escalation, to the Chief Risk Officer (simulated). Open 3 business days (twice the SLA of 1): SYS-04 Reviewer still Active; employee E0070 terminated 2026-10-23; last login 2026-10-27 is AFTER termination
The one that stayed open: M-02 A-0388
SYS-05 Admin account without documented approval (granted 2021-04-09). It was already open when monitoring began, so it was flagged on day one and kept escalating (21 business days open by the end of the window). Monitoring does not fix a control; it makes sure nobody can forget that it is broken.
- 2026-10-01: New exception, to the Head of Platform Engineering (simulated). Admin account without documented approval: SYS-05 Admin account without documented approval (granted 2021-04-09)
- 2026-10-07: SLA breach: escalated, to the Head of IT Operations (simulated). Open 4 business days (SLA 3): SYS-05 Admin account without documented approval (granted 2021-04-09)
- 2026-10-12: Second escalation, to the Chief Risk Officer (simulated). Open 7 business days (twice the SLA of 3): SYS-05 Admin account without documented approval (granted 2021-04-09)
Every exception
| M-02 | A-0170 | High | Pre-existing | 2026-10-01 | 2026-10-14 | 9 | yes | SYS-03 Admin account without documented approval (granted 2026-03-26) |
|---|---|---|---|---|---|---|---|---|
| M-01 | A-0329 | High | Pre-existing | 2026-10-01 | 2026-10-09 | 6 | yes | SYS-04 Developer still Active; employee E0354 terminated 2026-02-13 |
| M-02 | A-0388 | High | Pre-existing | 2026-10-01 | open at end of window | 21 | yes | SYS-05 Admin account without documented approval (granted 2021-04-09) |
| M-01 | A-0176 | High | New in window | 2026-10-12 | 2026-10-13 | 1 | no | SYS-03 Ledger Accountant still Active; employee E0212 terminated 2026-10-07 |
| M-01 | A-0269 | High | New in window | 2026-10-13 | 2026-10-16 | 3 | no | SYS-04 Release Manager still Active; employee E0172 terminated 2026-10-08 |
| M-02 | A-1003 | High | New in window | 2026-10-13 | 2026-10-16 | 3 | no | SYS-04 Admin account without documented approval (granted 2026-10-13) |
| M-03 | A-1009 | Medium | New in window | 2026-10-13 | 2026-10-19 | 4 | no | SYS-03 Standard human account has MFA disabled |
| M-01 | A-0015 | High | New in window | 2026-10-19 | open at end of window | 9 | yes | SYS-01 Support Agent still Active; employee E0052 terminated 2026-10-14 |
| M-02 | A-1005 | High | New in window | 2026-10-20 | open at end of window | 8 | yes | SYS-04 Admin account without documented approval (granted 2026-10-20) |
| M-03 | A-1012 | Medium | New in window | 2026-10-23 | open at end of window | 5 | no | SYS-01 Standard human account has MFA disabled |
| M-01 | A-0237 | Critical | New in window | 2026-10-27 | open at end of window | 3 | yes | SYS-04 Reviewer still Active; employee E0070 terminated 2026-10-23; last login 2026-10-27 is AFTER termination |
No rows match the current filters.
Every alert (simulated, never sent)
| AL-001 | 2026-10-01 | New exception | M-02 | A-0170 | High | Head of Platform Engineering | Admin account without documented approval: SYS-03 Admin account without documented approval (granted 2026-03-26) |
|---|---|---|---|---|---|---|---|
| AL-002 | 2026-10-01 | New exception | M-01 | A-0329 | High | IT Security Manager | Leaver account still active past the deadline: SYS-04 Developer still Active; employee E0354 terminated 2026-02-13 |
| AL-003 | 2026-10-01 | New exception | M-02 | A-0388 | High | Head of Platform Engineering | Admin account without documented approval: SYS-05 Admin account without documented approval (granted 2021-04-09) |
| AL-004 | 2026-10-07 | SLA breach: escalated | M-02 | A-0170 | High | Head of IT Operations | Open 4 business days (SLA 3): SYS-03 Admin account without documented approval (granted 2026-03-26) |
| AL-005 | 2026-10-07 | SLA breach: escalated | M-01 | A-0329 | High | Head of IT Operations | Open 4 business days (SLA 3): SYS-04 Developer still Active; employee E0354 terminated 2026-02-13 |
| AL-006 | 2026-10-07 | SLA breach: escalated | M-02 | A-0388 | High | Head of IT Operations | Open 4 business days (SLA 3): SYS-05 Admin account without documented approval (granted 2021-04-09) |
| AL-007 | 2026-10-09 | Resolved | M-01 | A-0329 | Info | IT Security Manager | Closed after 6 business days: SYS-04 Developer still Active; employee E0354 terminated 2026-02-13 |
| AL-008 | 2026-10-12 | New exception | M-01 | A-0176 | High | IT Security Manager | Leaver account still active past the deadline: SYS-03 Ledger Accountant still Active; employee E0212 terminated 2026-10-07 |
| AL-009 | 2026-10-12 | Second escalation | M-02 | A-0170 | High | Chief Risk Officer | Open 7 business days (twice the SLA of 3): SYS-03 Admin account without documented approval (granted 2026-03-26) |
| AL-010 | 2026-10-12 | Second escalation | M-02 | A-0388 | High | Chief Risk Officer | Open 7 business days (twice the SLA of 3): SYS-05 Admin account without documented approval (granted 2021-04-09) |
| AL-011 | 2026-10-13 | New exception | M-01 | A-0269 | High | IT Security Manager | Leaver account still active past the deadline: SYS-04 Release Manager still Active; employee E0172 terminated 2026-10-08 |
| AL-012 | 2026-10-13 | New exception | M-02 | A-1003 | High | Head of Platform Engineering | Admin account without documented approval: SYS-04 Admin account without documented approval (granted 2026-10-13) |
| AL-013 | 2026-10-13 | New exception | M-03 | A-1009 | Medium | IT Security Manager | Human account without multi-factor authentication: SYS-03 Standard human account has MFA disabled |
| AL-014 | 2026-10-13 | Resolved | M-01 | A-0176 | Info | IT Security Manager | Closed after 1 business days: SYS-03 Ledger Accountant still Active; employee E0212 terminated 2026-10-07 |
| AL-015 | 2026-10-14 | Resolved | M-02 | A-0170 | Info | Head of Platform Engineering | Closed after 9 business days: SYS-03 Admin account without documented approval (granted 2026-03-26) |
| AL-016 | 2026-10-16 | Resolved | M-01 | A-0269 | Info | IT Security Manager | Closed after 3 business days: SYS-04 Release Manager still Active; employee E0172 terminated 2026-10-08 |
| AL-017 | 2026-10-16 | Resolved | M-02 | A-1003 | Info | Head of Platform Engineering | Closed after 3 business days: SYS-04 Admin account without documented approval (granted 2026-10-13) |
| AL-018 | 2026-10-19 | New exception | M-01 | A-0015 | High | IT Security Manager | Leaver account still active past the deadline: SYS-01 Support Agent still Active; employee E0052 terminated 2026-10-14 |
| AL-019 | 2026-10-19 | Resolved | M-03 | A-1009 | Info | IT Security Manager | Closed after 4 business days: SYS-03 Standard human account has MFA disabled |
| AL-020 | 2026-10-20 | New exception | M-02 | A-1005 | High | Head of Platform Engineering | Admin account without documented approval: SYS-04 Admin account without documented approval (granted 2026-10-20) |
| AL-021 | 2026-10-23 | New exception | M-03 | A-1012 | Medium | IT Security Manager | Human account without multi-factor authentication: SYS-01 Standard human account has MFA disabled |
| AL-022 | 2026-10-23 | SLA breach: escalated | M-01 | A-0015 | High | Head of IT Operations | Open 4 business days (SLA 3): SYS-01 Support Agent still Active; employee E0052 terminated 2026-10-14 |
| AL-023 | 2026-10-26 | SLA breach: escalated | M-02 | A-1005 | High | Head of IT Operations | Open 4 business days (SLA 3): SYS-04 Admin account without documented approval (granted 2026-10-20) |
| AL-024 | 2026-10-27 | New exception | M-01 | A-0237 | Critical | IT Security Manager | Leaver account still active past the deadline: SYS-04 Reviewer still Active; employee E0070 terminated 2026-10-23; last login 2026-10-27 is AFTER termination |
| AL-025 | 2026-10-27 | Critical: immediate escalation | M-01 | A-0237 | Critical | Chief Risk Officer | Post-termination login detected: SYS-04 Reviewer still Active; employee E0070 terminated 2026-10-23; last login 2026-10-27 is AFTER termination |
| AL-026 | 2026-10-28 | Second escalation | M-01 | A-0015 | High | Chief Risk Officer | Open 7 business days (twice the SLA of 3): SYS-01 Support Agent still Active; employee E0052 terminated 2026-10-14 |
| AL-027 | 2026-10-29 | Second escalation | M-02 | A-1005 | High | Chief Risk Officer | Open 7 business days (twice the SLA of 3): SYS-04 Admin account without documented approval (granted 2026-10-20) |
| AL-028 | 2026-10-29 | SLA breach: escalated | M-01 | A-0237 | Critical | Head of IT Operations | Open 2 business days (SLA 1): SYS-04 Reviewer still Active; employee E0070 terminated 2026-10-23; last login 2026-10-27 is AFTER termination |
| AL-029 | 2026-10-30 | Second escalation | M-01 | A-0237 | Critical | Chief Risk Officer | Open 3 business days (twice the SLA of 1): SYS-04 Reviewer still Active; employee E0070 terminated 2026-10-23; last login 2026-10-27 is AFTER termination |
No rows match the current filters.
How this would run for real
- Replace the simulated feed with scheduled read-only extracts from the identity system and the HR termination feed, run on a schedule such as daily at an agreed time.
- Keep the same rules, severities and SLAs, agreed with the control owners, and record the rule and data versions with every run (the audit log in case study 5 shows the pattern).
- Send alerts through a ticketing or messaging tool, with the owner acknowledging each one, instead of writing a file.
- Tune the rules with the owners to limit false alarms, and review the monitor itself periodically, as an auditor would any automated control.
What this demo does not do
- It is not connected to any real system, and the feed is invented. The numbers say nothing about how often such failures happen.
- It covers three rules, not the whole control set. Controls that need judgement, such as access review quality, are not monitored by a rule.
- Alerts are written to a file, not sent. There is no acknowledgement workflow and no ticketing integration.
- A real deployment needs approval to access the data, a privacy review and ongoing tuning.
Downloads
- Monitoring READMEMD · 2 KB
- Monitoring policy (CSV)CSV · 1 KB
- Daily results (CSV)CSV · 3 KB
- Exception log (CSV)CSV · 2 KB
- Simulated alerts (CSV)CSV · 6 KB
- Feed events (CSV)CSV · 2 KB
- Summary (JSON)JSON · 1 KB
Back to case study 5 · Automation overview · Case study 1: the audit