Return to CHAPTER 20


state seal 20.28
Monitoring

20.28.10

July 1, 2017

Monitoring overview
 

Monitoring is the process of evaluating the quality of internal control performance over time and promptly addressing internal control deficiencies. Monitoring can take the form of ongoing evaluations, which are built into business processes at different levels of the agency, or separate evaluations, which are conducted periodically and vary in scope and frequency, depending on assessment of risks, effectiveness of ongoing evaluations, and other management considerations.

Monitoring of the internal control system is essential in helping internal control remain aligned with changing objectives, environment, laws, resources, and risks.

20.28.20

July 1, 2017

Monitoring principles
 

There are two principles relating to monitoring activities.

  1. Management establishes and performs activities to monitor the internal control system and evaluate the results.
  1. The agency evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action.

20.28.30

July 1, 2017

Monitoring versus control activities
 

It can be difficult to distinguish between a review that is a control activity and one that is a monitoring activity. Some judgment is involved but determining the intent of the activity can help. An activity designed to detect and correct errors is likely a control activity, while an activity designed to ask why there were errors in the first place and assign responsibility for fixing the process to prevent future errors is likely a monitoring activity. In other words, a control activity responds to a specific risk, while a monitoring activity assesses whether controls within each of the five components of internal control are operating as intended.

20.28.40

July 1, 2017

Principle 16 – Performs monitoring activities

 

Management establishes and performs activities to monitor the internal control system and evaluate the results. The following points of focus highlight important characteristics relating to this principle.

  • Establishes a baseline – Management establishes a baseline to monitor the internal control system. The baseline represents the difference between the criteria of the design of the internal control system and condition of the internal control system at a specific point in time.
  • Monitors the internal control system – Management performs ongoing monitoring of the design and operating effectiveness of the internal control system as part of the normal course of operations.
  • Evaluates the results – Management evaluates and documents the results of ongoing monitoring and separate evaluations to identify internal control issues. Separate evaluations may take the form of self-assessments, which include cross operating unit or cross functional evaluations. Separate evaluations also include audits and other evaluations that may involve the review of control design and direct testing of internal control.

20.28.50

July 1, 2017

Principle 17 – Evaluates and communicates deficiencies
 

The agency evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including those charged with governance and agency management, as appropriate. The following points of focus highlight important characteristics relating to this principle.

  • Communicates deficiencies – Deficiencies are communicated to parties responsible for taking corrective action, including those charged with governance and agency management, as appropriate. In certain circumstances, deficiencies are also communicated to the State Auditor’s Office refer to Subsection 70.75 and the Office of Financial Management on the Annual Financial Disclosure Certification. Refer to Subsection 90.40.95.
  • Assesses deficiencies – Management evaluates and documents internal control issues and, on a timely basis, determines appropriate corrective action for internal control deficiencies.
  • Documents and implements corrective action – Management documents corrective action to remediate internal control deficiencies. Corrective action includes resolution of audit findings. Depending on the nature of a deficiency, either those charged with governance or agency management oversee its prompt remediation by communicating the corrective action to the appropriate level of the organizational structure and delegating authority for completing corrective action to appropriate employees.


Click here if you would like to print a PDF Version of this document.
Return to CHAPTER 20