Monitoring and assurance
Compliance Monitoring, Reviews and Audits
The differences among ongoing monitoring, management review, compliance testing and independent audit.
Why this matters
The differences among ongoing monitoring, management review, compliance testing and independent audit.
Monitoring
Monitoring is recurring observation of indicators, exceptions, deadlines or transactions. It can be automated or manual and is often performed by the process owner or compliance function.
Management review
A management review evaluates results, patterns and unresolved issues. It should show what was reviewed, what questions were asked and what decisions followed.
Compliance testing
Testing examines selected controls or obligations using defined procedures and evidence. It may be risk-based and may sit within a compliance or risk function.
Internal audit
Internal audit provides independent assurance over governance, risk management and controls. Independence, scope and reporting lines distinguish it from routine monitoring.
Use the layers together
Monitoring can detect current exceptions; testing can assess control operation; audit can evaluate the overall framework. One layer should not be presented as a substitute for all others.
Questions to document
- Which obligations and processes are in scope?
- Who owns the activity and who independently reviews it?
- What record demonstrates that the activity operated?
- What happens when the control fails or circumstances change?
Related planning tools
Use the local planning tools to turn the concepts into a structured working note.