## Monitoring of Controls

Monitoring of controls is the fifth component of internal control (COSO). It is a process to assess the effectiveness of internal control performance over time.

### What Monitoring Involves

Assessing whether controls are operating as intended
Taking necessary remedial actions when controls fail
Modifying controls as appropriate for changes in conditions

### How Management Accomplishes Monitoring

Approach	Description
Ongoing monitoring	Built into normal recurring activities; includes regular management and supervisory activities
Separate evaluations	Periodic assessments conducted outside routine operations
Combination	Mix of both

### External Information Used in Monitoring

Management may use information from external parties:

Customer complaints → may indicate control failures
Regulator comments → may highlight areas needing improvement

### Auditor's Responsibility

The auditor shall obtain an understanding of the major activities the entity uses to monitor internal control over financial reporting.

Worked example

### Example 1

Scenario: Company A has a complaint management system where customer complaints are logged and reviewed monthly by the CFO. Analysis: This is ongoing monitoring using external information. The auditor should understand this activity and assess whether it effectively identifies control weaknesses.

### Example 2

Scenario: Company B conducts a quarterly internal audit of its procurement process. Analysis: This is a separate evaluation as part of monitoring. The auditor shall obtain an understanding of the scope and findings of these evaluations to assess their contribution to the monitoring component.

⚠️ Common exam mistakes

Confusing 'monitoring of controls' (management's ongoing process) with 'testing of controls' (auditor's procedure) — they are distinct activities performed by different parties.
Stating that monitoring only uses internal sources — external sources like customer complaints and regulator comments also form part of monitoring activities.
Forgetting that monitoring can be a combination of ongoing activities AND separate evaluations, not one or the other.

Reference: — SA 315 – Identifying and Assessing the Risks of Material Misstatement through Understanding the Entity and Its Environment (ICAI)

Now that you've read this — what's next?

Move from understanding → mastery in 3 clicks. Each option below picks up from this lesson's topic.

🔥 Drill 5 Qs on this → ✍️ Adaptive practice →

Monitoring of Controls (SA 315)

Worked example

⚠️ Common exam mistakes