Business Core · Compliance · Module

Monitoring

Checking that controls are actually operating, independently of the people who operate them.

The idea

How it works

Controls degrade quietly. People leave, systems change, workarounds appear, and the control continues to exist on paper long after it has stopped operating. Nothing announces this.

Monitoring must test operation rather than existence. Confirming that a procedure is documented tells you nothing about whether it was followed last month, and the two are different questions.

Working with it

In practice

  1. 01

    Test a sample of actual operation

    Pick real transactions and follow them. Ask for the evidence the control should have produced.

  2. 02

    Keep monitoring independent

    Someone other than the control owner. Self-assessment finds what it expects to find.

  3. 03

    Risk-weight the frequency

    High-consequence controls tested often; the rest on a rotation.

  4. 04

    Track findings to closure

    A finding raised and not closed is a known failure that has now been documented.

One level in

The components of monitoring

A component is something that exists afterwards which did not exist before — a deliverable or a mechanism, not an intention.

  1. The monitoring plan

    What is tested, how often, by whom — weighted by consequence.

    Learn
  2. The test record

    What was sampled, what was found, and against what evidence.

    Learn
  3. The findings log

    Open findings with owner and date, tracked to closure.

    Learn

Test operation, not documentation. A documented procedure says nothing about whether it was followed.