View source for Principle 16 - Perform Monitoring Activities

== 16.0 Perform Monitoring Activities ==
'''16.01 Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results.'''

=== 16.1 Establishment of a Baseline ===
'''16.02 Monitoring activities evaluate whether each of the five components of internal control, including controls to effect the principles within each component, is present and functioning or if change is needed.''' Management establishes a baseline to monitor the internal control system. The baseline is the current state of the internal control system compared against management’s design of the internal control system. The baseline represents the difference between the criteria for the design of the internal control system and the condition of the internal control system at a specific point in time. In other words, the baseline consists of issues and deficiencies identified in an entity’s internal control system.

'''16.03 Once established, management can use the baseline as criteria in evaluating the internal control system and make changes to reduce the difference between the criteria and condition.''' Management reduces this difference in one of two ways. Management either changes the design of the internal control system to better address the objectives and risks of the entity or improves the operating effectiveness of the internal control system. As part of monitoring, management determines when to revise the baseline to reflect changes in the internal control system.

=== 16.2 Internal Control System Monitoring ===
'''16.04 Management monitors the internal control system through ongoing monitoring and separate evaluations.''' Ongoing monitoring is built into the entity’s operations, performed continually, and responsive to change. Separate evaluations are performed periodically and may provide feedback on the effectiveness of ongoing monitoring. Many of the methods and tools described below may be used for both ongoing monitoring and separate evaluations, depending on when and how they are implemented.

'''16.05 Management performs ongoing monitoring of the design and operating effectiveness of the internal control system as part of the normal course of operations.''' Ongoing monitoring includes regular management and supervisory activities, comparisons, reconciliations, trend analysis, data analytics, activities to identify improper payments or potential fraud, testing, and other routine actions. Ongoing monitoring may include automated tools, which can increase objectivity and efficiency by electronically compiling evaluations of controls and transactions or by automating data analytics.

'''16.06 Management uses separate evaluations to monitor the design and operating effectiveness of the overall internal control system at a specific time or of a specific function or process.''' The scope and frequency of separate evaluations depend primarily on the assessment of risks, risk responses, evolving technology, identification of new risks or deficiencies, results of ongoing monitoring, and rate of change within the entity and its environment. Management may also increase the frequency of separate evaluations when management rapidly implements a new program or substantially changes an existing one, such as emergency assistance programs. Separate evaluations include observations, inquiries, reviews, improper payment estimates, and other examinations, as appropriate. These evaluate whether controls to effect principles across the entity are designed, implemented, and operating effectively. Separate evaluations may also take the form of self-assessments, which include crossoperating unit or cross-functional evaluations.

'''16.07 Management also uses the results of separate evaluations performed in connection with internal and external audits, investigations, and other evaluations that may involve the review of internal control design and testing of internal controls to help identify issues in the internal control system.''' These audits and other evaluations may be mandated by law and are performed by internal auditors, external auditors, inspectors general, and other reviewers. Separate evaluations provide greater objectivity when performed by reviewers who do not have responsibility for the activities being evaluated.

'''16.08 Management retains responsibility for monitoring the effectiveness of controls performed by service organizations that are necessary for the entity to achieve its control objectives.''' Management uses ongoing monitoring, separate evaluations, or a combination of the two to obtain reasonable assurance of the operating effectiveness of a service organization’s internal controls over the assigned process. Monitoring activities related to service organizations may include the use of work performed by external parties, such as service auditors, and reviewed by management.

=== 16.3 Evaluation of Results ===
'''16.09 Management evaluates and documents the results of ongoing monitoring and separate evaluations to identify internal control issues [documentation requirement].''' Management uses this evaluation to determine the effectiveness of the internal control system. Differences between the results of monitoring activities and the previously established baseline may indicate internal control issues, including undocumented changes in the internal control system or potential internal control deficiencies.

'''16.10 Management identifies changes in the internal control system that either have occurred or are needed because of changes in the entity and its environment.''' External parties can also help management identify issues in the internal control system. For example, complaints from the public, regulator comments, and findings from investigations may indicate areas in the internal control system that need improvement. Other external parties that interact with the entity, including relevant suppliers, contractors, and service organizations, may collaborate with management to identify and respond to issues in the entity’s business processes and related internal controls. Management considers whether current controls address the identified issues and modifies controls if necessary.{{Principles}}

== Related Story Events ==

* [[2020: The Event|🗳️ 2020: The Event — Election Monitoring]]
* [[November 2024: Midterm Election|⚠️ November 2024: Midterm Election]]