Principle 16 - Perform Monitoring Activities - Revision history

Kelly at 22:24, 13 August 2026

2026-08-13T22:24:34Z

← Older revision		Revision as of 22:24, 13 August 2026
Line 38:		Line 38:

	==== '''16.10''' ====		==== '''16.10''' ====
	Management identifies changes in the internal control system that either have occurred or are needed because of changes in the entity and its environment. External parties can also help management identify issues in the internal control system. For example, complaints from the public, regulator comments, and findings from investigations may indicate areas in the internal control system that need improvement. Other external parties that interact with the entity, including relevant suppliers, contractors, and service organizations, may collaborate with management to identify and respond to issues in the entity’s business processes and related internal controls. Management considers whether current controls address the identified issues and modifies controls if necessary.~~{{Principles}}~~		Management identifies changes in the internal control system that either have occurred or are needed because of changes in the entity and its environment. External parties can also help management identify issues in the internal control system. For example, complaints from the public, regulator comments, and findings from investigations may indicate areas in the internal control system that need improvement. Other external parties that interact with the entity, including relevant suppliers, contractors, and service organizations, may collaborate with management to identify and respond to issues in the entity’s business processes and related internal controls. Management considers whether current controls address the identified issues and modifies controls if necessary.

	~~== Related Story Events ==~~		{{Principles}}

			=== Related Story Events ===
	* [[2020: The Event\|🗳️ 2020: The Event — Election Monitoring]]		* [[2020: The Event\|🗳️ 2020: The Event — Election Monitoring]]
	* [[November 2024: Midterm Election\|⚠️ November 2024: Midterm Election]]		* [[November 2024: Midterm Election\|⚠️ November 2024: Midterm Election]]

Kelly at 22:23, 13 August 2026

2026-08-13T22:23:50Z

← Older revision		Revision as of 22:23, 13 August 2026
Line 1:		Line 1:
	== 16.0 Perform Monitoring Activities ==		== 16.0 Perform Monitoring Activities ==
	'''16.01 Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results.~~'''~~		[https://guides.gaoinnovations.gov/greenbook/2025/principle-16-perform-monitoring-activities/ External Link to US GAO Green Book Principle 16]

			=== Overview ===

			==== '''16.01''' ====
			Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results.

	=== 16.1 Establishment of a Baseline ===		=== 16.1 Establishment of a Baseline ===
	'''16.02 Monitoring activities evaluate whether each of the five components of internal control, including controls to effect the principles within each component, is present and functioning or if change is needed.''' Management establishes a baseline to monitor the internal control system. The baseline is the current state of the internal control system compared against management’s design of the internal control system. The baseline represents the difference between the criteria for the design of the internal control system and the condition of the internal control system at a specific point in time. In other words, the baseline consists of issues and deficiencies identified in an entity’s internal control system.

	'''16.03 Once established, management can use the baseline as criteria in evaluating the internal control system and make changes to reduce the difference between the criteria and condition.~~'''~~ Management reduces this difference in one of two ways. Management either changes the design of the internal control system to better address the objectives and risks of the entity or improves the operating effectiveness of the internal control system. As part of monitoring, management determines when to revise the baseline to reflect changes in the internal control system.		==== '''16.02''' ====
			Monitoring activities evaluate whether each of the five components of internal control, including controls to effect the principles within each component, is present and functioning or if change is needed. Management establishes a baseline to monitor the internal control system. The baseline is the current state of the internal control system compared against management’s design of the internal control system. The baseline represents the difference between the criteria for the design of the internal control system and the condition of the internal control system at a specific point in time. In other words, the baseline consists of issues and deficiencies identified in an entity’s internal control system.

			==== '''16.03''' ====
			Once established, management can use the baseline as criteria in evaluating the internal control system and make changes to reduce the difference between the criteria and condition. Management reduces this difference in one of two ways. Management either changes the design of the internal control system to better address the objectives and risks of the entity or improves the operating effectiveness of the internal control system. As part of monitoring, management determines when to revise the baseline to reflect changes in the internal control system.

	=== 16.2 Internal Control System Monitoring ===		=== 16.2 Internal Control System Monitoring ===
	'''16.04 Management monitors the internal control system through ongoing monitoring and separate evaluations.''' Ongoing monitoring is built into the entity’s operations, performed continually, and responsive to change. Separate evaluations are performed periodically and may provide feedback on the effectiveness of ongoing monitoring. Many of the methods and tools described below may be used for both ongoing monitoring and separate evaluations, depending on when and how they are implemented.

	'''16.05 Management ~~performs ongoing monitoring of the design and operating effectiveness of~~ the internal control system ~~as part of the normal course of operations~~.~~'''~~ Ongoing monitoring ~~includes regular management and supervisory activities~~, ~~comparisons~~, ~~reconciliations, trend analysis, data analytics, activities~~ to ~~identify improper payments or potential fraud, testing,~~ and ~~other routine actions~~. ~~Ongoing~~ monitoring ~~may include automated tools, which can increase objectivity~~ and ~~efficiency by electronically compiling~~ evaluations ~~of controls~~ and ~~transactions or by automating data analytics~~.		==== '''16.04''' ====
			Management monitors the internal control system through ongoing monitoring and separate evaluations. Ongoing monitoring is built into the entity’s operations, performed continually, and responsive to change. Separate evaluations are performed periodically and may provide feedback on the effectiveness of ongoing monitoring. Many of the methods and tools described below may be used for both ongoing monitoring and separate evaluations, depending on when and how they are implemented.

	'''16.06 Management ~~uses separate evaluations to monitor~~ the design and operating effectiveness of the ~~overall~~ internal control system ~~at a specific time or~~ of ~~a specific function or process~~.~~''' The scope~~ and ~~frequency of separate evaluations depend primarily on the assessment of risks~~, ~~risk responses~~, ~~evolving technology~~, ~~identification of new risks or deficiencies~~, ~~results of ongoing monitoring~~, ~~and rate of change within the entity and its environment. Management may also increase the frequency of separate evaluations when management rapidly implements a new program~~ or ~~substantially changes an existing one, such as emergency assistance programs. Separate evaluations include observations~~, ~~inquiries, reviews, improper payment estimates~~, and other ~~examinations, as appropriate~~. ~~These evaluate whether controls to effect principles across the entity are designed, implemented~~, and ~~operating effectively. Separate~~ evaluations ~~may also take the form~~ of ~~self-assessments, which include crossoperating unit~~ or ~~cross-functional evaluations~~.		==== '''16.05''' ====
			Management performs ongoing monitoring of the design and operating effectiveness of the internal control system as part of the normal course of operations. Ongoing monitoring includes regular management and supervisory activities, comparisons, reconciliations, trend analysis, data analytics, activities to identify improper payments or potential fraud, testing, and other routine actions. Ongoing monitoring may include automated tools, which can increase objectivity and efficiency by electronically compiling evaluations of controls and transactions or by automating data analytics.

	'''16.07 Management ~~also~~ uses ~~the results of~~ separate evaluations ~~performed in connection with internal and external audits, investigations, and other evaluations that may involve~~ the ~~review of internal control~~ design and ~~testing~~ of ~~internal controls to help identify issues in~~ the internal control system.~~''' These audits~~ and ~~other~~ evaluations may ~~be mandated by law~~ and are ~~performed by internal auditors~~, ~~external auditors, inspectors general~~, and ~~other reviewers~~. Separate evaluations ~~provide greater objectivity when performed by reviewers who do not have responsibility for~~ the ~~activities being evaluated~~.		==== '''16.06''' ====
			Management uses separate evaluations to monitor the design and operating effectiveness of the overall internal control system at a specific time or of a specific function or process. The scope and frequency of separate evaluations depend primarily on the assessment of risks, risk responses, evolving technology, identification of new risks or deficiencies, results of ongoing monitoring, and rate of change within the entity and its environment. Management may also increase the frequency of separate evaluations when management rapidly implements a new program or substantially changes an existing one, such as emergency assistance programs. Separate evaluations include observations, inquiries, reviews, improper payment estimates, and other examinations, as appropriate. These evaluate whether controls to effect principles across the entity are designed, implemented, and operating effectively. Separate evaluations may also take the form of self-assessments, which include crossoperating unit or cross-functional evaluations.

	'''16.08 Management retains responsibility for monitoring the effectiveness of controls performed by service organizations that are necessary for the entity to achieve its control objectives.~~'''~~ Management uses ongoing monitoring, separate evaluations, or a combination of the two to obtain reasonable assurance of the operating effectiveness of a service organization’s internal controls over the assigned process. Monitoring activities related to service organizations may include the use of work performed by external parties, such as service auditors, and reviewed by management.		==== '''16.07''' ====
			Management also uses the results of separate evaluations performed in connection with internal and external audits, investigations, and other evaluations that may involve the review of internal control design and testing of internal controls to help identify issues in the internal control system. These audits and other evaluations may be mandated by law and are performed by internal auditors, external auditors, inspectors general, and other reviewers. Separate evaluations provide greater objectivity when performed by reviewers who do not have responsibility for the activities being evaluated.

			==== '''16.08''' ====
			Management retains responsibility for monitoring the effectiveness of controls performed by service organizations that are necessary for the entity to achieve its control objectives. Management uses ongoing monitoring, separate evaluations, or a combination of the two to obtain reasonable assurance of the operating effectiveness of a service organization’s internal controls over the assigned process. Monitoring activities related to service organizations may include the use of work performed by external parties, such as service auditors, and reviewed by management.

	=== 16.3 Evaluation of Results ===		=== 16.3 Evaluation of Results ===
	'''16.09 Management evaluates and documents the results of ongoing monitoring and separate evaluations to identify internal control issues [documentation requirement].''' Management uses this evaluation to determine the effectiveness of the internal control system. Differences between the results of monitoring activities and the previously established baseline may indicate internal control issues, including undocumented changes in the internal control system or potential internal control deficiencies.

	'''16.10 Management identifies changes in the internal control system that either have occurred or are needed because of changes in the entity and its environment.~~'''~~ External parties can also help management identify issues in the internal control system. For example, complaints from the public, regulator comments, and findings from investigations may indicate areas in the internal control system that need improvement. Other external parties that interact with the entity, including relevant suppliers, contractors, and service organizations, may collaborate with management to identify and respond to issues in the entity’s business processes and related internal controls. Management considers whether current controls address the identified issues and modifies controls if necessary.{{Principles}}		==== '''16.09''' ====
			Management evaluates and documents the results of ongoing monitoring and separate evaluations to identify internal control issues '''[documentation requirement].''' Management uses this evaluation to determine the effectiveness of the internal control system. Differences between the results of monitoring activities and the previously established baseline may indicate internal control issues, including undocumented changes in the internal control system or potential internal control deficiencies.

			==== '''16.10''' ====
			Management identifies changes in the internal control system that either have occurred or are needed because of changes in the entity and its environment. External parties can also help management identify issues in the internal control system. For example, complaints from the public, regulator comments, and findings from investigations may indicate areas in the internal control system that need improvement. Other external parties that interact with the entity, including relevant suppliers, contractors, and service organizations, may collaborate with management to identify and respond to issues in the entity’s business processes and related internal controls. Management considers whether current controls address the identified issues and modifies controls if necessary.{{Principles}}

	== Related Story Events ==		== Related Story Events ==

Kelly at 04:52, 6 August 2026

2026-08-06T04:52:16Z

Show changes

Kelly at 04:50, 6 August 2026

2026-08-06T04:50:00Z

@@ Line 105: / Line 105: @@
 current controls address the identified issues and modifies controls if
 necessary.
 == Related Story Events ==
@@ Line 110: / Line 112: @@
 * [[2020: The Event|🗳️ 2020: The Event — Election Monitoring]]
 * [[November 2024: Midterm Election|⚠️ November 2024: Midterm Election]]

Kelly: Added cross-links to story events

2026-08-03T23:52:55Z

Added cross-links to story events

← Older revision		Revision as of 23:52, 3 August 2026
Line 105:		Line 105:
	current controls address the identified issues and modifies controls if		current controls address the identified issues and modifies controls if
	necessary.		necessary.

			== Related Story Events ==

			* [[2020: The Event\|🗳️ 2020: The Event — Election Monitoring]]
			* [[November 2024: Midterm Election\|⚠️ November 2024: Midterm Election]]

			== Navigation ==

			{\| class="wikitable" style="width: 100%;"
			! colspan="3" \| Quick Navigation
			\|-
			\| style="width: 33%; text-align: center;" \| [[Main Page\|🏠 Main Page]]
			\| style="width: 33%; text-align: center;" \| [[The Story\|📖 The Story]]
			\| style="width: 33%; text-align: center;" \| [[Governance Analysis\|📊 Governance Analysis]]
			\|}

Kelly: Auto-created by CAP AZ bot

2026-08-03T23:49:38Z

Auto-created by CAP AZ bot

New page

16.01 Management should establish and operate monitoring activities to
monitor the internal control system and evaluate the results.

Establishment of a Baseline

16.02 Monitoring activities evaluate whether each of the five components
of internal control, including controls to effect the principles within
each component, is present and functioning or if change is needed.
Management establishes a baseline to monitor the internal control
system. The baseline is the current state of the internal control system
compared against management’s design of the internal control system. The
baseline represents the difference between the criteria for the design
of the internal control system and the condition of the internal control
system at a specific point in time. In other words, the baseline
consists of issues and deficiencies identified in an entity’s internal
control system.

16.03 Once established, management can use the baseline as criteria in
evaluating the internal control system and make changes to reduce the
difference between the criteria and condition. Management reduces this
difference in one of two ways. Management either changes the design of
the internal control system to better address the objectives and risks
of the entity or improves the operating effectiveness of the internal
control system. As part of monitoring, management determines when to
revise the baseline to reflect changes in the internal control system.

Internal Control System Monitoring

16.04 Management monitors the internal control system through ongoing
monitoring and separate evaluations. Ongoing monitoring is built into
the entity’s operations, performed continually, and responsive to
change. Separate evaluations are performed periodically and may provide
feedback on the effectiveness of ongoing monitoring. Many of the methods
and tools described below may be used for both ongoing monitoring and
separate evaluations, depending on when and how they are implemented.

16.05 Management performs ongoing monitoring of the design and operating
effectiveness of the internal control system as part of the normal
course of operations. Ongoing monitoring includes regular management and
supervisory activities, comparisons, reconciliations, trend analysis,
data analytics, activities to identify improper payments or potential
fraud, testing, and other routine actions. Ongoing monitoring may
include automated tools, which can increase objectivity and efficiency
by electronically compiling evaluations of controls and transactions or
by automating data analytics.

16.06 Management uses separate evaluations to monitor the design and
operating effectiveness of the overall internal control system at a
specific time or of a specific function or process. The scope and
frequency of separate evaluations depend primarily on the assessment of
risks, risk responses, evolving technology, identification of new risks
or deficiencies, results of ongoing monitoring, and rate of change
within the entity and its environment. Management may also increase the
frequency of separate evaluations when management rapidly implements a
new program or substantially changes an existing one, such as emergency
assistance programs. Separate evaluations include observations,
inquiries, reviews, improper payment estimates, and other examinations,
as appropriate. These evaluate whether controls to effect principles
across the entity are designed, implemented, and operating effectively.
Separate evaluations may also take the form of self-assessments, which
include crossoperating unit or cross-functional evaluations.

16.07 Management also uses the results of separate evaluations performed
in connection with internal and external audits, investigations, and
other evaluations that may involve the review of internal control design
and testing of internal controls to help identify issues in the internal
control system. These audits and other evaluations may be mandated by
law and are performed by internal auditors, external auditors,
inspectors general, and other reviewers. Separate evaluations provide
greater objectivity when performed by reviewers who do not have
responsibility for the activities being evaluated.

16.08 Management retains responsibility for monitoring the effectiveness
of controls performed by service organizations that are necessary for
the entity to achieve its control objectives. Management uses ongoing
monitoring, separate evaluations, or a combination of the two to obtain
reasonable assurance of the operating effectiveness of a service
organization’s internal controls over the assigned process. Monitoring
activities related to service organizations may include the use of work
performed by external parties, such as service auditors, and reviewed by
management.

Evaluation of Results

16.09 Management evaluates and documents the results of ongoing
monitoring and separate evaluations to identify internal control issues
[documentation requirement]. Management uses this evaluation to
determine the effectiveness of the internal control system. Differences
between the results of monitoring activities and the previously
established baseline may indicate internal control issues, including
undocumented changes in the internal control system or potential
internal control deficiencies.

16.10 Management identifies changes in the internal control system that
either have occurred or are needed because of changes in the entity and
its environment. External parties can also help management identify
issues in the internal control system. For example, complaints from the
public, regulator comments, and findings from investigations may
indicate areas in the internal control system that need improvement.
Other external parties that interact with the entity, including relevant
suppliers, contractors, and service organizations, may collaborate with
management to identify and respond to issues in the entity’s business
processes and related internal controls. Management considers whether
current controls address the identified issues and modifies controls if
necessary.