Business Core · Compliance · Module
Monitoring
Checking that controls are actually operating, independently of the people who operate them.
The idea
How it works
Controls degrade quietly. People leave, systems change, workarounds appear, and the control continues to exist on paper long after it has stopped operating. Nothing announces this.
Monitoring must test operation rather than existence. Confirming that a procedure is documented tells you nothing about whether it was followed last month, and the two are different questions.
Working with it
In practice
- 01
Test a sample of actual operation
Pick real transactions and follow them. Ask for the evidence the control should have produced.
- 02
Keep monitoring independent
Someone other than the control owner. Self-assessment finds what it expects to find.
- 03
Risk-weight the frequency
High-consequence controls tested often; the rest on a rotation.
- 04
Track findings to closure
A finding raised and not closed is a known failure that has now been documented.
One level in
The components of monitoring
A component is something that exists afterwards which did not exist before — a deliverable or a mechanism, not an intention.
Test operation, not documentation. A documented procedure says nothing about whether it was followed.
The other modules in compliance
Regulatory mapping
Establishing which rules actually apply — by jurisdiction, sector and activity — before deciding how to meet them.
LearnControls
The mechanisms that make compliance happen — built into how work is done, rather than checked afterwards.
LearnIncident response
What happens when something goes wrong — containment, notification and correction — decided in advance rather than during.
Learn