Summary

Ongoing evaluations, separate evaluations, or some combination of the two are used to ascertain whether each of the five components of internal control, including controls to effect the principles within each component, is present and functioning. Ongoing evaluations, built into business processes at different levels of the entity, provide timely information. Separate evaluations, conducted periodically, will vary in scope and frequency depending on assessment of risks, effectiveness of ongoing evaluations, and other management considerations. Findings are evaluated against criteria established by regulators, standard-setting bodies, or management and board of directors, and deficiencies are communicated to management and the board of directors as appropriate.

Monitoring activities assess whether each of the five components of internal control is present and functioning. The organization uses ongoing, separate evaluations, or some combination of the two, to ascertain whether the components of internal control (including controls to effect principles across the entity and its subunits) are present and functioning. Monitoring is a key input into the organization’s assessment of the effectiveness of internal control. It provides valuable support for assertions, if required, regarding the effectiveness of the system of internal control.

An entity’s system of internal control will often change. The entity’s objectives and the components of internal control may also change over time. Also, procedures may become less effective or obsolete, may no longer be in place and functioning, or may be deemed insufficient to support the achievement of the new or updated objectives. Monitoring activities are selected, developed, and performed to ascertain whether each component continues to be present and functioning or if change is needed. When a component or a principle drawn from the five components is not present and functioning, some form of internal control deficiency exists. Management also needs to determine whether the system of internal control continues to be relevant and is able to address new risks.

Where appropriate, monitoring activities identify and examine expectation gaps relating to anomalies and abnormalities, which may indicate one or more deficiencies in an entity’s system of internal control. In reviewing and investigating expectation gaps management often identifies root causes of such gaps.

When distinguishing between a monitoring activity and a control activity, organizations need to consider underlying details of the activity in determining whether an activity is a control activity versus a monitoring activity, especially where the activity involves some level of supervisory review. Supervisory reviews are not automatically classified as monitoring activities and it may be a matter of judgment whether a review is classified as a control activity or a monitoring activity. For example, the intent of a monthly completeness control activity would be to detect and correct errors, where a monitoring activity would ask why there were errors in the first place and assign management the responsibility of fixing the process to prevent future errors. In simple terms, a control activity responds to a specific risk, whereas a monitoring activity assesses whether controls within each of the five components of internal control are operating as intended, among other things.

Principles relating to the Monitoring Activities component

16. The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.


17. The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.

Conducts Ongoing and/or Separate Evaluations

Principle 16: The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.

Points of Focus

The following points of focus may assist management in determining whether this principle is present and functioning:

• Considers a Mix of Ongoing and Separate Evaluations—Management includes a balance of ongoing and separate evaluations.
• Considers Rate of Change—Management considers the rate of change in business and business processes when selecting and developing ongoing and separate evaluations.
• Establishes Baseline Understanding—The design and current state of an internal control system are used to establish a baseline for ongoing and separate evaluations.
• Uses Knowledgeable Personnel—Evaluators performing ongoing and separate evaluations have sufficient knowledge to understand what is being evaluated.
• Integrates with Business Processes—Ongoing evaluations are built into the business processes and adjust to changing conditions.
• Adjusts Scope and Frequency—Management varies the scope and frequency of separate evaluations depending on risk.
• Objectively Evaluates—Separate evaluations are performed periodically to provide objective feedback.

Evaluates and Communicates Deficiencies

Principle 17: The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.

Points of Focus

The following points of focus may assist management in determining whether this principle is present and functioning:

• Assesses Results—Management and the board of directors, as appropriate, assess results of ongoing and separate evaluations.
• Communicates Deficiencies—Deficiencies are communicated to parties responsible for taking corrective action and to senior management and the board of directors, as appropriate.
• Monitors Corrective Actions—Management tracks whether deficiencies are remediated on a timely basis.