Enforcement deadlines have passed. National authorities across the EU are moving from publishing guidance to running supervision, and the practical burden is landing on compliance teams that were built for annual audit cycles.
From guidance to supervision
For most of the transposition period, regulators communicated expectations rather than testing them. That has changed. Supervisory bodies now request evidence, compare entities against each other, and expect the same question to produce the same answer twice.
This is where manual assessment breaks down first. Two qualified auditors reviewing the same organization routinely reach different conclusions, because scoring rests on interpretation rather than on evidence that can be re-examined. When a regulator compares fifty entities, that variance stops being an inconvenience and becomes a defensibility problem.
What changes operationally
Four shifts account for most of the additional workload teams are reporting this year:
- Evidence must be retained and retrievable, not reconstructed before an audit
- Scope changes trigger re-assessment rather than waiting for the next cycle
- Remediation actions are tracked to completion, with owners and dates
- Management sign-off is explicit and personally attributable
An annual audit produces a snapshot that is outdated the moment it is signed. Supervision assumes a current state, not a historical one.
— IVERIOS compliance team
Why the annual cycle no longer fits
Systems change, staff turn over, suppliers are replaced, and new vulnerabilities appear continuously. A control that was effective in March may not be in October, and nothing in a yearly cadence surfaces that gap. Teams compensate with a scramble in the weeks before an assessment, which produces documentation rather than assurance.
What to do next
Start by fixing scope and evidence handling, since both determine how much rework every later assessment requires. Then move re-assessment frequency to match how quickly your environment actually changes, rather than to the audit calendar. Structured, evidence-based assessment makes that cadence affordable — the cost of running an assessment stops scaling with the number of entities being assessed.
