Ongoing and Separate Monitoring

Introduction: Why Ongoing and Separate Monitoring Matters

Risk management is not a one-time exercise. Risks evolve, controls decay, personnel change, and business strategies shift. The only way an organization can be confident that its risk management processes remain effective over time is through monitoring. The IIA's Certification in Risk Management Assurance (CRMA) exam tests your understanding of how monitoring works, and specifically the distinction between ongoing monitoring (built into operations) and separate monitoring (periodic, independent evaluations). This concept sits within the broader domain of evaluating risk management processes, and it is a frequently tested area because it connects frameworks such as COSO ERM and COSO Internal Control–Integrated Framework to the practical work of internal auditors and risk practitioners.

Without effective monitoring, management may believe that risk responses are working when in fact they have become stale or ineffective. Monitoring provides the feedback loop that keeps the entire risk management system alive. For a CRMA candidate, understanding this feedback loop is essential, both for passing the exam and for performing meaningful assurance work in practice.

What Is Monitoring in Risk Management?

Monitoring is the component of a risk management or internal control framework that assesses whether the other components are present and functioning as intended over time. In the COSO Internal Control–Integrated Framework (2013), monitoring is one of the five components and is governed by two principles:

• Principle 16: The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.
• Principle 17: The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.

In COSO ERM 2017 (Enterprise Risk Management–Integrating with Strategy and Performance), the equivalent concept appears in the Review and Revision component, which includes assessing substantial change, reviewing risk and performance, and pursuing improvement in enterprise risk management. Both frameworks emphasize that monitoring is what allows management to identify when risk management practices need to adapt.

Monitoring answers a simple but powerful question: Is our risk management actually working, and how do we know?

The Two Types of Monitoring

1. Ongoing Monitoring

Ongoing monitoring consists of activities that are built into the normal, recurring operations of the organization. They occur in real time or near real time, are performed by operating management and staff as part of their regular duties, and react dynamically to changing conditions.

Characteristics of ongoing monitoring:
• Embedded in business processes and performed continuously
• Conducted by line management and process owners (first line in the Three Lines Model)
• Provides early detection of problems
• Often automated or supported by technology (dashboards, exception reports, key risk indicators)
• Less formal and typically less independent than separate evaluations

Examples of ongoing monitoring:
• Supervisory review of daily transaction reports
• Reconciliations performed as part of the monthly close
• Automated system alerts when transactions exceed authorized thresholds
• Tracking key risk indicators (KRIs) against risk appetite and tolerance levels
• Management review of operational metrics and variance analysis
• Customer complaint tracking and analysis
• Self-assessments integrated into operational routines

2. Separate Monitoring (Separate Evaluations)

Separate monitoring consists of evaluations conducted periodically, apart from day-to-day operations, usually by individuals who are objective and independent of the activity being evaluated. These evaluations take a fresh look at the design and operating effectiveness of risk management processes and controls.

Characteristics of separate monitoring:
• Performed periodically rather than continuously
• Conducted by individuals independent of the process (internal audit, external audit, compliance, risk functions, or management from outside the area)
• Greater objectivity and depth than ongoing monitoring
• Scope and frequency are based on risk assessment, the effectiveness of ongoing monitoring, and the rate of change in the environment
• Results are typically documented and formally reported

Examples of separate monitoring:
• Internal audit engagements evaluating risk management processes
• Control self-assessment (CSA) workshops facilitated by risk or audit functions
• External audits and regulatory examinations
• Periodic management reviews of risk assessments and risk registers
• Benchmarking against peer organizations or industry standards
• Independent quality assurance reviews

How Ongoing and Separate Monitoring Work Together

The relationship between the two types is central to the exam. Key points to remember:

• They are complementary, not substitutes. Effective monitoring usually involves a combination of both. Ongoing monitoring provides continuous coverage and early warning; separate evaluations provide objective validation and catch what ongoing processes may miss.

• The strength of ongoing monitoring determines the need for separate evaluations. This is an inverse relationship. The more robust and effective ongoing monitoring is, the less frequent or extensive separate evaluations need to be. Conversely, weak or absent ongoing monitoring increases the need for separate evaluations. COSO explicitly states that the scope and frequency of separate evaluations depend primarily on the assessment of risks and the effectiveness of ongoing monitoring procedures.

• Separate evaluations also assess ongoing monitoring itself. One of the most valuable things a separate evaluation does is test whether the ongoing monitoring activities are functioning as designed. For example, an internal audit may test whether supervisors are actually reviewing exception reports and taking action.

• Both feed into deficiency reporting. Whatever the source, identified deficiencies must be evaluated for severity and communicated to the appropriate level of management and, where significant, to the board.

Factors Influencing the Monitoring Mix

When deciding how to balance ongoing and separate monitoring, organizations consider:
• The significance of the risk being managed (higher-risk areas warrant more rigorous monitoring)
• The rate of change in the business, technology, regulation, or personnel
• The competence and objectivity of those performing ongoing monitoring
• The complexity of the process or control
• Results of prior evaluations and history of deficiencies
• Availability and reliability of data to support monitoring
• Cost-benefit considerations

Internal Audit's Role in Monitoring

For CRMA purposes, it is critical to understand where internal audit fits. Under the IIA's Three Lines Model, internal audit is the third line, providing independent and objective assurance. Internal audit's evaluation of risk management processes is itself a form of separate monitoring. Internal audit evaluates:

• Whether risk management processes are designed appropriately
• Whether management's ongoing monitoring activities are effective
• Whether risk responses and controls are operating as intended
• Whether deficiencies are being identified, escalated, and remediated
• Whether risk information reported to the board is accurate and complete

IIA Standards require internal audit to evaluate the effectiveness and contribute to the improvement of risk management processes. Importantly, internal audit must preserve independence: it should not assume management's responsibility for ongoing monitoring, make risk management decisions, or own risk responses. Internal audit can facilitate, advise, and assure, but the first and second lines own the risks and the ongoing monitoring activities.

Monitoring Risk Management Processes Specifically

Beyond monitoring individual controls, the CRMA exam asks about monitoring the risk management process itself. This means evaluating whether:
• Risk identification processes capture emerging and changing risks
• Risk assessments are updated when conditions change
• Risk appetite and tolerance statements remain aligned with strategy
• Risk responses remain appropriate and cost-effective
• Risk information is communicated to the right people at the right time
• Lessons from risk events and near misses are captured and acted upon

Key risk indicators (KRIs) are a powerful ongoing monitoring tool for this purpose, as they provide leading signals that risk exposure is changing before losses materialize. Separate evaluations, such as a periodic internal audit of the ERM framework, provide assurance that the whole system is sound.

Evaluating and Communicating Deficiencies

Monitoring is only useful if findings lead to action. The framework requires that deficiencies be:
• Evaluated for severity (is it a minor deficiency, a significant deficiency, or a material weakness?)
• Communicated to those who can take corrective action, typically the responsible manager plus at least one level above
• Escalated to senior management and the board when significant
• Tracked through to remediation, with follow-up to confirm correction

Internal audit typically plays a role in follow-up, confirming that management has implemented agreed-upon actions or that senior management has accepted the risk of not acting.

Exam Tips: Answering Questions on Ongoing and Separate Monitoring

Tip 1: Know the defining distinction cold. If a question describes an activity performed continuously by operating personnel as part of routine duties, it is ongoing monitoring. If it describes a periodic, independent review performed apart from operations, it is separate monitoring. Many questions simply test classification, so anchor on two words: continuous/embedded versus periodic/independent.

Tip 2: Remember the inverse relationship. A classic question asks what happens to the need for separate evaluations when ongoing monitoring is strong. The answer: the need for separate evaluations decreases in frequency and scope. Weak ongoing monitoring means more separate evaluations are required. Do not fall for options suggesting that strong ongoing monitoring eliminates the need for separate evaluations entirely; the exam expects a combination.

Tip 3: Internal audit is separate monitoring, not ongoing monitoring. Questions may try to tempt you into assigning internal audit a role in ongoing monitoring or in owning risk responses. Internal audit evaluates ongoing monitoring; it does not perform it as a routine operational function. Any answer that compromises internal audit's independence is almost certainly wrong.

Tip 4: Watch for Three Lines Model framing. Ongoing monitoring is primarily a first-line (management) activity, with second-line functions (risk, compliance) providing oversight and additional monitoring. Separate evaluations come from the third line (internal audit) and external parties. Match the activity to the line.

Tip 5: Link monitoring to COSO principles. Be ready to recognize Principle 16 (perform ongoing and/or separate evaluations) and Principle 17 (evaluate and communicate deficiencies). Also connect the concept to COSO ERM 2017's Review and Revision component. The exam rewards candidates who can see monitoring as part of a framework rather than an isolated idea.

Tip 6: Understand what drives scope and frequency. If asked what determines how often separate evaluations should occur, the best answer references the risk assessment and the effectiveness of ongoing monitoring. Secondary factors include the rate of change and prior findings. Avoid answers based solely on budget, calendar convenience, or audit committee preference.

Tip 7: Deficiencies must go up the chain. When a question involves a deficiency discovered through monitoring, the correct response involves communicating to the responsible party and at least one level higher, with escalation to senior management and the board for significant matters. Answers that leave the deficiency with the person who caused it, or that delay communication, are wrong.

Tip 8: KRIs are ongoing; audits of the risk framework are separate. Key risk indicators tracked on a dashboard are a textbook example of ongoing monitoring of risk management. An internal audit of the ERM program or a benchmarking study is a textbook example of separate monitoring. Scenario questions often use these two examples.

Tip 9: Read for the word "best" or "most." Several answer options may be partially correct. The exam wants the most complete or most appropriate response. When evaluating risk management effectiveness, the best answer usually combines ongoing and separate approaches, emphasizes independence where assurance is required, and ties results back to corrective action.

Tip 10: Think like an assurance provider. When a scenario asks how an internal auditor should evaluate whether risk management processes are effective, consider: Is ongoing monitoring in place and functioning? Are separate evaluations risk-based and sufficiently frequent? Are deficiencies communicated and remediated? Is the board receiving reliable risk information? An answer that addresses these questions reflects the CRMA mindset.

Summary

Ongoing monitoring is continuous, embedded in operations, and performed by management; separate monitoring is periodic, independent, and performed by parties such as internal audit. They work together, with the strength of ongoing monitoring inversely affecting the need for separate evaluations. Both exist to confirm that risk management processes remain present and functioning, and both must lead to timely evaluation and communication of deficiencies. Internal audit's role is to provide independent assurance through separate evaluations while preserving its objectivity. Master these distinctions and relationships, and you will be well prepared for any CRMA question on this topic.