Most internal audit teams still look at a process once a year, test a sample and report months after the transactions took place. By the time a finding reaches the audit committee, the duplicate payment has cleared, the supplier has gone and the control weakness has been there for a whole financial year. Continuous auditing and continuous monitoring change the timing. Instead of looking back once, you test whole populations of transactions on a regular cycle and deal with exceptions while they still matter.
This guide explains the difference, gives a step-by-step approach, a template you can adapt, and the mistakes that usually derail these programmes.
Continuous auditing vs continuous monitoring: who owns what
The two terms are often used as if they mean the same thing. They don’t, and mixing them up creates problems with independence.
- Continuous monitoring belongs to management. It is how the first and second lines check, on an ongoing basis, that controls are working: for example, a finance manager reviewing a daily report of payments released without a second approver, or a bank’s compliance unit screening transactions against sanctions lists.
- Continuous auditing belongs to internal audit. It is the repeated, largely automated testing of controls and transactions to give ongoing assurance, and to find out whether management’s own monitoring is working.
The IIA’s Global Technology Audit Guide (GTAG) on continuous auditing and monitoring describes the two as complementary: where management monitoring is strong, internal audit can rely on it more and focus on checking that it works. Where it is weak or missing, internal audit’s continuous auditing has to do more of the detailed testing, and the gap itself becomes a finding.
There is also a standards angle. Under the IIA’s Global Internal Audit Standards (2024), the chief audit executive is expected to make sure the function has the technology it needs to do its work (Standard 10.3, Technological Resources). A continuous auditing programme is one of the clearest ways to show you are doing that.
Step-by-step: building a continuous auditing programme
Step 1: Start from the risk assessment, not the data
Pick three to five high-risk areas from your audit universe where transactions are high in volume and held in a system. Good first candidates are accounts payable, payroll, procurement, user access, and (in banks) dormant account reactivations and staff accounts. In a Zimbabwean public entity, this could be payments against the approved budget and procurement thresholds. In an NGO, it might be donor-funded expenditure against grant budgets and eligible cost categories.
Step 2: Define the control objective and the rule
For each risk, write down the control that should prevent it and a rule that would show the control failing. “Every payment above the delegated limit needs two approvals” becomes the rule “list payments above the limit where the second approver field is empty or matches the first approver.”
Step 3: Secure data access and agree the extract
Agree with IT a standard, read-only extract for each rule: the tables, fields, date range and format. Check that record counts and control totals agree to the source system each time you run it.
Step 4: Set thresholds and frequency
Not every rule needs to run daily. Match the frequency to the risk and to how fast someone can act. Set thresholds that keep the number of exceptions manageable. A rule that produces 2,000 exceptions a week will be ignored.
Step 5: Pilot, tune and then automate
Run each rule on historical data first. Investigate a sample of exceptions to find false positives (for example, legitimate split deliveries that look like split purchases) and refine the rule. Only automate once the false-positive rate is acceptable.
Step 6: Agree an exception workflow
Decide in advance who receives exceptions, how quickly they must respond, and what counts as a resolved exception. Exceptions should go to the process owner first. Internal audit follows up on items that are not cleared and looks at trends.
Step 7: Report trends, not just individual items
Report to management and the audit committee on what the exceptions show over time: are they falling, concentrated in one branch or department, linked to one user? That is where the assurance value lies.
A simple continuous auditing rule register
Keep a register of every rule. It becomes your programme documentation and makes it easy to hand the work over if staff move on. Here is a starting template with example entries:
| Rule ID | Risk / control objective | Test logic | Data source | Frequency | Exception owner | Response time |
|---|---|---|---|---|---|---|
| AP-01 | Duplicate payments are prevented | Same supplier, same amount, same or similar invoice number within 30 days | AP payment file | Weekly | Finance Manager | 5 working days |
| AP-02 | Payments above the delegated limit have two approvals | Amount above limit and second approver blank or the same as the first | Payment approval log | Weekly | Finance Manager | 3 working days |
| PR-01 | Only active employees are paid | Payroll records with no matching active HR record, or a shared bank account | Payroll and HR master files | Monthly, before payroll run | HR Manager | Before payment |
| PROC-01 | Purchases are not split to avoid tender thresholds | Same supplier, several orders just below the threshold within 14 days | Purchase order file | Monthly | Procurement Manager | 10 working days |
| IT-01 | Leavers lose system access promptly | Active user accounts belonging to staff marked as exited | User access list and HR exit list | Monthly | IT Security Officer | 2 working days |
Many of these rules can start in Excel. As volumes grow, for example a full year of bank transactions or a payroll covering several thousand staff, a dedicated tool such as ProDataTool lets you filter and summarise millions of rows without the spreadsheet slowing down or crashing.
Common mistakes and how to avoid them
- Starting with the technology. Buying software or building scripts before agreeing which risks matter leads to dashboards nobody uses. Start from the risk assessment.
- Internal audit doing management’s job. If internal audit ends up clearing every exception, it is effectively running a control, which weakens its objectivity. Exceptions belong with process owners.
- Too many false positives. Untuned rules flood users with noise. Pilot on historical data and refine before going live.
- No data validation. If the extract is incomplete, a clean result is meaningless. Reconcile record counts and totals every run.
- Ignoring context changes. Thresholds go out of date when delegated limits, procurement thresholds or currency arrangements change. In Zimbabwe, where entities may record transactions in both ZiG and US dollars, make sure each rule handles currency consistently. Review rules at least once a year.
Measuring whether the programme works
Track a few simple indicators every quarter:
- The number of rules live, and the share of high-risk areas covered.
- The number of exceptions raised, and the share confirmed as real issues.
- The average time to resolve an exception, by department.
- Recurring exceptions that point to a control weakness needing a formal audit finding.
- Rules handed over to management as part of their own continuous monitoring.
That last indicator is a good sign of maturity. Once a rule works well, hand it to management and shift internal audit’s role to assuring that monitoring.
Conclusion
Continuous auditing and continuous monitoring don’t require a large budget or a data science team. They need clear risks, well-defined rules, reliable data, an agreed exception workflow and regular reporting. Start with a handful of rules in your highest-risk processes, tune them carefully, and build from there. Over time, internal audit moves from reporting on last year’s problems to helping fix this month’s.
Bring your audit programme into one place. Exceptions from continuous auditing only add value if they turn into documented findings, assigned actions and clear reports. Auditors Track GRC helps audit teams across Africa digitise their work: risk assessments, audit reviews, findings and report writing, evidence attachments, dashboards by department and engagement type, and multi-user department assignments. It also comes with built-in libraries of controls, audits, working papers and risks to get you started. Book a free demo of Auditors Track GRC and see how it can support your continuous auditing programme.