Practice 03 · Monitor always
Controls tested every cycle, not once a year.
A standing programme that turns your key controls into data tests, runs them on full transaction populations every month or quarter, and brings management a short exception report while the problem is still small. IFC testing falls out of it.
Continuous Control Monitoring is a standing programme that converts agreed controls into repeatable data tests on full transaction populations, every cycle, and produces an exception register with owner, ageing and remediation.
An annual audit sees a control once a year. Monitoring watches it every cycle. We codify the controls that matter, procure-to-pay, payroll, revenue, treasury, ITGC, into repeatable tests, run them on the complete population from your ERP, and triage every exception with the process owner before it reaches management.
- Payment volumes have outgrown approvals as a control.
- The same observations repeat in every assurance report.
- IFC testing is a yearly scramble that the statutory auditor still questions.
- The promoter wants to know this month, not next quarter.
Sampling finds what it happens to land on. A duplicate vendor bank account, a contractor billed at last year’s rate, a ghost on the payroll: each is small per transaction and large per year, and none of them shows up in a 25-item sample.
- Month 1Build the test library for your processes: three-way match breaks, duplicate or shared vendor bank accounts, contractor rates against current contracts, headcount against gate-pass data, credit notes and price overrides beyond limits, segregation-of-duties conflicts, journals outside business hours. Baseline run.
- Days 1 to 2 of each cycleData extracts land, tests run on the full population. ERP-agnostic: SAP, Oracle, Tally, Zoho or standard extracts. No software purchase is a precondition.
- Days 3 to 5Exceptions validated with process owners. What management receives is a short list of real issues, not a data dump.
- Days 6 to 7Two-page cycle report: what broke, what it cost, what to change, with the quarter’s trend.
- Exception register per cycle: control, item, value, owner, age, status.
- Quarterly trend the audit committee sees as one line, not a stack of annexures.
- IFC assertion file: the same tests documented to assertion standard, so nothing is tested twice.
- A control library that grows with the business.
Questions
Asked before the first call.
Is this software?
No. It is an assurance service run by chartered accountants on your ERP extracts. We use analytics tools internally; you buy nothing.
What is the difference between continuous control monitoring and continuous auditing?
Monitoring is management’s tool: controls watched every cycle so exceptions are fixed early. Continuous auditing is the auditor using the same data to form an opinion. Our programme serves both, and the audit committee sees the trend.
Does it replace Governance & Controls Assurance?
It replaces the sampling part of it. Judgement areas, process redesign and the audit committee conversation remain assurance work, and the Governance & Controls Assurance practice runs alongside.
Which ERPs do you work with?
Any that can give standard extracts: SAP, Oracle, Microsoft Dynamics, Tally, Zoho, Busy and custom systems. The first month is spent on the extracts.
How is IFC covered?
Where monitoring is running, IFC design and operating-effectiveness testing is the same work documented to assertion standard. For companies that only want the annual IFC review, we run that as a 4 to 6 week engagement.
Related practices