Why Information Technology controls fail in safety-critical environments: A review of design and operational effectiveness

Abstract

Information technology controls are intended to safeguard operations in safety-critical environments across the United States, yet they frequently fall short of expectations. This review synthesizes evidence on why controls designed for compliance and risk management often fail in practice. Audit practices and compliance frameworks can improve effectiveness and resilience when integrated with mature risk management, yet they encounter subjectivity, inconsistency, and burdensome documentation once deployed. Framework and model design, including maturity approaches and hybrid analytical tools, promises mitigation of control challenges but reveals gaps in interpretability, ethical governance, and real-world deployment. Governance adaptation in development and operations and information technology-operational technology settings balances effectiveness gains with tensions around speed, role transitions, and fragmentation. Technical detection tools and maturity models enhance detection and resilience yet introduce new deployment complexities in healthcare and safety-critical systems. Policy directives and guidance documents outline methodologies and best practices but rarely provide empirical validation of outcomes. The synthesis shows that control failure arises primarily from the persistent gap between design intent and operational reality. Organizations that treat controls as dynamic systems rather than static requirements are better positioned to close this gap. The findings highlight the need for approaches that prioritize integration, adaptability, and continuous empirical validation to strengthen control performance in high-stakes settings. Keywords: Information Technology Controls, Safety-Critical Environments, Cybersecurity Audits, Regulatory Compliance, Design-Operation Gap.