Monitoring Controls: Who Checks Whether Controls Still Work?

A control can exist on paper and still stop working in practice. Monitoring connects everyday control operation to evidence, escalation and correction.

Start with the risk and the owner

For each important control, state the risk it addresses, the person accountable for operation and the evidence expected. A policy owner and a control performer may be different people. Clarify who follows up when performance deteriorates.

Consider an illustrative supplier-master approval. The approval workflow may still be enabled, but emergency overrides, staff changes or incomplete supporting documents can weaken its operation. A green workflow status alone does not answer whether the intended risk is being controlled.

Monitor the evidence of operation

Choose information that reveals performance: unresolved exceptions, missing approvals, overdue reconciliations, repeated overrides or incomplete follow-up. Define the population, period and source before relying on a dashboard.

Check whether the data itself is complete and reliable enough for the monitoring purpose. Zero reported exceptions can mean good performance, an ineffective detection rule or a missing data feed. Investigate the explanation rather than treating the colour as assurance.

Match the evaluation to the risk

COSO's discussion of monitoring principles 16 and 17 describes ongoing and separate evaluations and timely communication of deficiencies. The mix and frequency should respond to the circumstances, including change and risk.

A stable process may require a different approach from a newly deployed system or a rapidly changing payment process. Monitoring should be reconsidered when systems, people, volumes or business models change. This is a practical application of the principles, not a prescribed daily or monthly schedule.

Separate roles without losing coordination

Management remains accountable for running controls and correcting weaknesses. Risk and compliance functions can provide monitoring, expertise and challenge. Internal audit can assess the reliability of that work and provide independent assurance.

The IIA's current Statements of Position identify internal audit as the independent third line. Its refreshed Three Lines statement was issued on 8 July 2026. Where additional responsibilities are assigned, independence and objectivity safeguards matter.

Avoid making the auditor the routine approver of a control the auditor will later assess. Coordination should strengthen coverage without obscuring who owns the decision or correction.

Turn a deficiency into a tracked response

Record the condition, risk consequence and available evidence. Assign an accountable owner, a proportionate response and a target date. Escalate significant or persistent weaknesses through the appropriate management and governance channels.

An illustrative missing-approval issue could arise from training, access design, workload or a deliberate bypass. The action should address the supported cause. Sending another reminder is not necessarily a remedy for a configuration that allows approvals to be skipped.

Reassess before closure

A completed action is different from an effective correction. Determine what changed, whether it was implemented and what evidence supports its operation over a relevant period. Keep unresolved limitations visible.

For the supplier example, retaining the remediation ticket is useful, but checking subsequent changes and override use may be needed to assess whether the weakness persists. The extent of follow-up depends on the risk and purpose; one clean transaction does not prove universal effectiveness.

Monitoring closes the loop when evidence changes the response—not when the dashboard merely turns green.