Continuous controls monitoring (CCM)

Management's own automated, ongoing surveillance of whether its controls are operating — a first- and second-line activity, not an audit one.

CCM is management watching its own controls: automated checks that run against live data and raise an alert when something breaks. Done well it shortens the distance between a control failing and somebody noticing from months to hours.

The distinction that vendor copy routinely erases: CCM belongs to the first and second lines. Continuous auditing belongs to the third. They can look almost identical in a demo — same data, same queries, similar dashboards — but they answer different questions and are owned by different people. Monitoring asks “are my controls working?”. Auditing asks “is management’s assertion that its controls are working reliable?”.

When internal audit builds and operates the monitoring, it has taken on a management activity and must then provide assurance over its own work. That is an independence problem no amount of tooling fixes, and it is the most common way a well-intentioned modernisation programme quietly destroys the thing that made the function valuable.

The workable arrangement is for audit to rely on CCM after testing it — which is ordinary reliance work, and one of the higher-leverage things a modern function can do.