Monitoring, Auditing, and Internal Investigations
What the domain tests
This domain covers ongoing monitoring, independent auditing, and the investigation process. Candidates must distinguish monitoring (ongoing, management-owned, real-time or periodic checks of transactions and controls) from auditing (independent, risk-based, periodic testing with a formal opinion). Investigations are fact-finding processes triggered by allegations, monitoring findings, or audit results.
Concepts to master
- Monitoring tools: transaction testing, data analytics, surveillance, control self-assessments, and key risk indicators.
- Audit characteristics: independence, objectivity, risk-based scope, sampling, workpapers, and reporting to the audit committee.
- Investigation lifecycle: intake and triage, conflict check, scoping, evidence preservation, interviews, documentation, findings, remediation, and closure.
- Privilege and confidentiality, whistleblower protection, non-retaliation, and regulatory reporting obligations.
- Remediation tracking to verify fixes actually occurred.
Traps
Questions often blur monitoring and audit, or place audit under management, destroying independence. A frequent trap is an investigation conducted by someone with a conflict of interest, or one that skips evidence preservation. Another is closing a matter without root-cause analysis and remediation. Watch for answers that promise confidentiality absolutely when legal or regulatory disclosure may be required.
Rule of thumb
Monitor continuously, audit independently, investigate objectively. Every investigation should end with a documented finding, a root cause, and a tracked remediation.
Worked example
A hotline report alleges a manager steered contracts to a relative's firm. The best answer: triage, check for conflicts among investigators, preserve records, conduct interviews, engage legal counsel on privilege and reporting, determine findings, apply discipline per policy, remediate the conflict-of-interest control, and monitor for recurrence.