After reading, you can choose a handful of measures that show a control failing, and act on what they reveal.
Definition
It sits between the control and the audit. A control runs day to day, monitoring checks that it ran, and an audit independently assesses the whole.
Clause 9.1 of ISO/IEC 27001 asks you to decide what is monitored and measured, how, when and by whom, and who analyses the results. COSO makes monitoring activities one of its five components.
Why it matters
A control that worked on audit day may have stopped the following week, and without monitoring nobody finds out until something breaks.
It also spreads the work of proving compliance across the year, which leaves far less to rebuild before an audit.
How it works
Pick what to check, beginning with the controls and obligations where failure costs the most. Give each a measure, a target, a frequency and an owner.
Collect the results, automatically where you can, and record every exception along with its cause.
Show management the trend. Turn repeated failures into corrective actions, and adjust the plan as obligations change.
A worked case
The measure: departed staff whose access was removed within one working day. The target is 100%, and HR and IT check it monthly.
In March, 11 of 12 cases meet it. The exception is a contractor who was missing from the HR list, so contractors are added to the list, with an owner and a date.
Good practices
- Keep the measures few, each tied to a real obligation.
- Prefer data from systems over declarations from people.
- Set the target before you look at the results.
- Have someone other than the control's operator look at the figures from time to time.
Common mistakes
- Collecting figures nobody reads, usually because no decision depends on them.
- Measuring activity, such as training sessions held, instead of the result you wanted.
- Fixing each exception without asking why it happened, so that the same failure returns next month.
Questions
- What is the difference between compliance monitoring and auditing?
- Monitoring is ongoing and done by those responsible for the process. An audit is periodic, independent and follows a defined programme.
- How often should controls be checked?
- In proportion to the risk and to how often the control runs. Daily controls may be sampled monthly, and yearly ones checked when they occur.
- What is continuous control monitoring?
- The automated collection of control results from systems such as identity or cloud platforms, which reduces manual sampling.
- Who receives the monitoring results?
- The control owner first, then the compliance lead. Management gets a short overview.
- Which compliance indicators work best?
- Those tied to a requirement, with a target and a clear owner, such as overdue reviews or the time taken to remove access.