MO02 Controls Assessment

Monitor internal control, assessing their effectiveness, and reporting on them on a regular basis.

Internal Control Monitoring: monitor the effectiveness of internal controls in the normal course of operations through management and supervisory activities, comparisons, reconciliations and other routine actions. Deviations should evoke analysis and corrective action,
Internal Control Level Reporting: report information on internal control levels and exceptions to the affected parties to ensure the continued effectiveness of its internal control system,
Operational Security and Internal Control Assurance: Examine whether or not the security and internal controls are operating according to the stated or implied security and internal control requirements.

Index of senior management satisfaction and comfort with reporting on internal control monitoring
Decreased probability of internal control incidents
Positive external qualification and certification reports
Number of control improvement initiatives
Absence of regulatory or legal non-compliance events
Decreased number of security incidents and quality defects

Management clearly defines what components of the processes need to be controlled
Internal control, compliance and internal audit responsibilities are clearly understood
Competence and authority of the internal control compliance function exist, addressing delegation as appropriate
A properly defined IT control process framework is in place
A clear process is used for timely reporting of internal control deficiencies
Internal control monitoring data is accurate, complete and timely
There is management commitment to act on internal control deficiencies
There is alignment with risk assessment and security processes
A process is in place to support knowledge sharing on internal control incidents and solutions