Continuous Monitoring Activity

Background

 In September 2018, the Operational Risk Management Framework (ORMF)

was updated to reflect the concept of “continuous monitoring” which is the
primary way in which Control Owners evaluate the ongoing effectiveness of
their controls.

What is continuous monitoring?

 Continuous Monitoring is the regular ongoing monitoring and challenge of

the control environment’s design and operating effectiveness. It is
mandatory for all the key controls.
 All the key controls linked to a very high or high inherit risk and locally
significant risks (LSRs) must be subject to continuous monitoring activities.
 The control owners is accountable for:-

Creation of the continuous monitoring plan

 The control owner must summarize the continuous monitoring activities that
they have in place to monitor the ongoing effectiveness of a control in a
continuous monitoring plan (CMP) which is recorded in helios. The design
of the CMP is therefore critical in order to ensure that the right activities are
placed.

Execution of the CMP and recording the results

 The CMP must be executed on regular basis (according to the frequency

recorded in helios) and the results must be recorded in helios. The results
evidence whether the controls is working as intended or not.

Continuous Monitoring

 What - 1. Continous monitoring includes the day to day activities a

control owner undertakes to ensure their controls are designed and
operating effectively.
2. Continuous monitoring plans should summarize the key activities that the
control owner has in place on a regular ongoing basis (this should not include
assurance activities)

3. For example, continuous monitoring could include a combination of exception

reports, MI reviews and trend analysis, supervisory techniques, check list
completion, regular risk management are equivalent forums, day to day
management activities, monitoring metrics against thresholds, the set up and use of
escalation channels, management spot checking, incident management, issue and
problem, root cause analysis, capacity planning, training needs analysis, etc.

Scope:-

1) All key controls linked to a very high or high inherent risk or locally
significant risks must be subject to continuous monitoring.
2) Relevant country Risk Management Meeting (RMM) must approve the
classification of locally significant risks with the expectation this is only a
small number of risks.

Who:-

Control owners are accountable for continuous monitoring of the design and
operating effectiveness of key controls and must attest to the performance of their
continuous monitoring and the current effectiveness of their controls environment.
This accountability cannot be delegated.

Control owners must evidence continuous monitoring attestation for SOX key
controls on at least on an annual basis.