OVERVIEW

Monitoring is the process of assessing and ensuring that all components of internal control and risk management are functioning properly as designed. Internal control is not a one-time event. Controls need to provide continuing ongoing assurance. Business is dynamic from day to day, and perhaps even faster as the pace of innovation and dissemination of information accelerates. Organizational structures shift and change to meet the demands of business. New personnel are hired and others depart. People drive the evolution of business processes and operate them. Management needs to have continuing assurance that processes and controls are functioning as designed.

Management needs to understand the level of effectiveness of internal control across the enterprise. Accordingly, the continuous evaluation and assessment of internal controls is a major component of management responsibility. The degree of assessment and evaluation depends on the level of risk associated with the process controls in place. Monitoring of internal controls is accomplished in two primary ways: ongoing monitoring and separate evaluation. Considering the accelerated pace of business and transactions, the most appropriate method is ongoing monitoring. However, there may be a need to back up and take a fresh look at the processes and controls through application of separate evaluations. Monitoring typically involves some blend of the two approaches. Section 404 requires that management assess the controls it designed to provide assurance for reliable financial reporting and compliance with laws and regulations. This assessment is intended to provide assurance that both approaches to monitoring internal control and...