## Monitoring of Controls

### Definition

Monitoring of controls is a process to assess the effectiveness of internal control performance over time. It is one of the five components of internal control.

### Purpose

Helps management assess whether controls are working on a timely basis
Identifies areas needing improvement

### How Management Accomplishes Monitoring

Management may monitor controls through:

1. Ongoing activities — built into routine operations (e.g., supervisory review of daily reports)

2. Separate evaluations — periodic reviews independent of routine operations (e.g., internal audits)

3. Combination of both

### Sources of Information for Monitoring

Information from external parties (e.g., customer complaints, regulator comments)
These may signal problems or areas needing control improvement

### Special Case: Small Entities

In small entities, monitoring is often accomplished by management's or the owner-manager's close involvement in operations — formal monitoring activities may be minimal.

### Auditor's Obligation: Entities with Internal Audit Function

If the entity has an internal audit function, the auditor must obtain an understanding of:

The responsibilities of the internal audit function and how it fits in the organisational structure
The activities performed (or to be performed) by the internal audit function

Worked example

### Example 1

Example (Ongoing Monitoring): A bank requires branch managers to review daily exception reports flagging transactions above a threshold. This is ongoing monitoring — it is embedded in daily operations. The auditor notes this as part of understanding the monitoring component.

### Example 2

Example (Small Entity): A sole-proprietor retail shop has no formal internal audit. The owner reviews daily cash totals personally. The auditor recognises that monitoring here relies entirely on the owner's direct involvement, which may be sufficient given the entity's size but creates key-person dependency.

### Example 3

Example (Internal Audit Function): A listed company has an Internal Audit (IA) department that reports to the Audit Committee. The auditor obtains the IA's charter, review the scope of work planned for the year, and assesses whether IA's work can be used to reduce the auditor's own procedures.

⚠️ Common exam mistakes

Treating monitoring as synonymous with internal audit — monitoring is broader and includes all ongoing and separate evaluation activities, not just IA.
Ignoring the small entity exception — in small firms, owner involvement substitutes for formal monitoring mechanisms.
Forgetting that when an internal audit function exists, the auditor has a mandatory obligation to understand its structure and activities (not just optionally consider it).

Reference:

Now that you've read this — what's next?

Move from understanding → mastery in 3 clicks. Each option below picks up from this lesson's topic.

🔥 Drill 5 Qs on this → ✍️ Adaptive practice →