Monitoring, Auditing, and Testing
Monitoring, Auditing, and Testing
Monitoring, testing, and audit are distinct assurance activities. Monitoring is ongoing, performed by the first or second line, and focuses on whether controls operate day to day (exception reports, quality checks, sampling). Testing is periodic, risk-based, and independent of the control owner, and it evaluates design and operating effectiveness. Internal audit is independent, reports to the audit committee, and provides overall assurance on the control environment.
Candidates must know the components of a test: scope, sample selection, test steps, evidence standards, results, ratings, and remediation tracking. A common trap is confusing a finding with a recommendation; the finding states the issue and its risk, the recommendation proposes the fix. Another trap is testing only design and ignoring operating effectiveness, or vice versa.
Sampling questions appear frequently. Larger samples are needed for higher-risk or higher-volume populations; judgmental and statistical sampling have different strengths. Documented rationale matters more than the method chosen.
Issue management is core: findings should be risk-rated, assigned an owner and due date, tracked to closure, and validated. Repeat findings signal weak root-cause analysis and weak remediation.
Worked example / rule of thumb: To test a transaction monitoring alert-review control, define the population, select a risk-based sample, verify each alert was reviewed within the required timeframe with documented rationale, rate the results, and track exceptions. Rule of thumb: a control is effective only if it operates as designed, consistently, over the testing period.
Expect questions on independence, escalation of significant findings, and the difference between assurance and consulting.