Monitoring activities assess whether each of the five components of internal control and relevant principles is present and functioning. The organization uses ongoing, separate evaluations, or some combination of the two, to ascertain whether the components of internal control (including controls to effect principles across the entity and its subunits) are present and functioning. Monitoring is a key input of the organization's assessment of the effectiveness of internal control. It also provides valuable support for assertions of the effectiveness of the system of internal control.

An entity's system of internal control will often change. The entity's objectives and the components of internal control may also change over time. Also, controls may become less effective or obsolete, may no longer be deployed in the manner in which they were selected or developed, or may be deemed insufficient to support the achievement of the new or updated objectives. Monitoring activities are selected, developed, and performed to ascertain whether each component continues to be present and functioning or if change is needed. Monitoring activities provide valuable input for management to use when determining whether the system of internal control continues to be relevant and is able to address new risks.

Where appropriate, monitoring activities identify and examine expectation gaps relating to anomalies and abnormalities, which may indicate one or more deficiencies in an entity's system of internal control. When reviewing and investigating expectation gaps, management often identifies root causes of such gaps. In ascertaining whether the five components of internal control are present and functioning, monitoring activities consider controls within each of the five components. Management evaluates these controls and how they effect principles; for example, assessing controls selected and deployed by the organization for:

When distinguishing between a monitoring activity and a control activity, organizations need to consider underlying details of the activity, especially where the activity involves some level of supervisory review. Supervisory reviews are not automatically classified as monitoring activities and it may be a matter of judgment whether a review is classified as a control activity or a monitoring activity. For example, the intent of a monthly completeness control activity would be to detect and correct errors, where a monitoring activity would ask why there were errors in the first place and assign management the responsibility of fixing the process to prevent future errors. In simple terms, a control activity responds to a specific risk, whereas a monitoring activity assesses whether controls within each of the five components of internal control are operating as intended.

The examples below illustrate the relationship between control activities and monitoring activities of a payable reconciliation.