The Global Internal Audit Standards ask for the risk assessment to be done at least once a year, but they also expect the chief audit executive to "keep continuously apprised of risk information" and the plan to be dynamic. If the environment is dynamic, the considerations for Standard 9.4 say, the plan may need updating "as frequently as every six months, quarterly, or even monthly."

A note on vocabulary before going further. The Standards do not use the phrase continuous auditing, nor continuous monitoring. Where they speak of "ongoing monitoring," they mean the day-to-day review of the internal audit function itself, as part of its internal quality assessment under Standard 12.1. Here we use continuous monitoring in the ordinary sense of the trade, which is repeating tests on the organisation's data at intervals.

That practice is far from widespread. In the global survey behind the IIA's Vision 2035 report, with 6,506 responses gathered in February and March 2024, only 27% report a high level of implementation of continuous monitoring.

It is easy to assume that monitoring continuously means redoing the engagement every quarter. It does not. It is enough to repeat a well-defined test on comparable cut-offs and to keep what is needed for each run to stand on its own.

What makes a cut-off count

  • The same extract, with the same definition. Same system, same fields and the same rule for delimiting the population. If the source or the filter changes, the result is a new baseline, not a continuation of the previous one.
  • Every run with its version of the program. Which version of the work program was applied, with what scope, at what cut-off date and over what period. Standard 14.1 lists as evidence of conformance a description of the information gathered, "including its source, the date it was gathered, and the period to which it pertains."
  • Repeatable by someone else. Standard 14.6 requires documentation such that an informed, prudent internal auditor "could repeat the work and derive the same engagement results." Applied to cut-offs, it means any past run can be reproduced with its program and its data from that time.

The first cut-off with all of that kept is the baseline. The following ones are read against it.

Comparing without asking more than it gives

The comparison with the previous cycle is useful, but it is a signal, not an inference. If a control's exceptions go from a handful to many more, that tells you where to look. It does not, on its own, say the control has got worse. The volume, the population or the business rule may have changed. Before turning a variation into a finding, the variation has to be explained.

That is why each cut-off's result should separate three groups. New exceptions, exceptions that persist and exceptions that disappear. The first two call for analysis. The third calls for something more demanding.

An action is not closed because someone says so

Standard 15.2 requires confirming that management has implemented its action plans following a methodology that includes inquiring about progress and performing follow-up assessments "using a risk-based approach." Cut-offs fit there naturally. If management reports that it has fixed a control, the next comparable cut-off is the new evidence that confirms it or contradicts it.

The practical rule is simple. No action is treated as implemented without evidence dated after the fix. An email from management does not count. An exception that stops appearing in a comparable cut-off does.

A cut-off that cannot be repeated with the same program is not monitoring. It is just another snapshot.

This approach does not require rebuilding the plan, but it makes it genuinely dynamic, because each cut-off feeds the risk assessment for the next one. It is the difference between a plan that can move in March and one written in November and executed without looking up, as we argued when discussing audit effort that does not follow the risk.