Continuous auditing is internal audit using technology to assess risks and controls on an ongoing basis. Continuous monitoring is management checking, on an ongoing basis, that its own controls work. Continuous assurance is the result: ongoing comfort for the board that risk and control are working. The techniques overlap. The owner is what differs.
Last reviewed: 17 October 2026. Facts checked. We ran a web search and opened the IIA's overview page on its guidance for continuous auditing and monitoring. That page describes continuous auditing as using technology to provide ongoing assessments of risks and controls, and links continuous assurance to internal audit giving the board and senior management ongoing assurance. It does not define continuous monitoring or say who owns it. The ownership split below comes from search summaries of the IIA guide (2015 second edition and a newer edition the IIA lists as effective 25 September 2025) and an ISACA Journal article, not from the full guide text, which we did not open. Check the IIA guide for exact wording.
The three terms in plain words
| Term | Plain meaning | Who owns it |
|---|---|---|
| Continuous auditing | Internal audit runs tests on data or controls regularly, instead of once a year | Internal audit |
| Continuous monitoring | Management runs checks on its own controls and risks as part of operations | Management (the first and second lines) |
| Continuous assurance | The ongoing conclusion that risk management and controls work, given to the board | Internal audit, drawing on both |
The IIA overview links continuous assurance to internal audit. Commentary on the guide says the techniques are usually similar and the key difference is who owns the process.
Why ownership matters
If management checks its own control, that check is a control. It cannot be independent. If internal audit runs a similar test, it is independent assurance. Both are useful. Confusing them leads to two common errors:
- Audit says "we monitor continuously" and quietly takes over management's job. Then nobody independent is left to challenge it.
- Management says "audit tests this" and drops its own checks.
The same split appears in the three lines model. Our comparison with MIS shows what each function sees.
How they work together
Search summaries of the IIA guide say the audit approach depends on how far management has built continuous monitoring. Strong management monitoring can reduce the testing internal audit has to do. Audit then tests whether the monitoring itself is reliable.
In practice:
- Management sets up monitoring rules over its controls, for example duplicate payment checks.
- Internal audit reviews those rules, tests the data feeding them and runs its own tests where risk is high.
- Results from both feed an ongoing view for the audit committee.
Examples
| Area | Continuous monitoring (management) | Continuous auditing (internal audit) |
|---|---|---|
| Payments | Daily duplicate invoice report reviewed by finance | Audit re-runs the test on the full year and checks the report was acted on |
| Access | HR sends leaver list; IT removes access | Audit compares leavers with active users |
| Expenses | Policy limits in the expense tool | Audit tests overrides and split claims |
What each is not
- Not a once-a-year audit with a bigger sample. The point is regular testing, often of the whole population.
- Not a dashboard alone. A dashboard without follow-up and evidence is only reporting.
- Not a replacement for judgment. Exceptions still need an auditor to decide what they mean.
How to start
1. Pick one high-risk process
Choose a process with clean data and a clear risk, such as payments or payroll.
2. Write the rule in plain words
"Flag any two invoices with the same vendor, amount and date." If you cannot write it plainly, you cannot test it.
3. Decide who owns the rule
If management owns the control, management owns the monitoring rule. If audit runs it, audit owns it.
4. Set thresholds and a response
Say who reviews an exception, in how many days, and what happens if they do not.
5. Keep evidence
Save the run date, data source, result and action. Without this you cannot rely on it.
6. Review the rules
Rules go stale when the business changes. Review them at least when processes change. Use the monitoring rules library as a starting point.
Checklist
- Terms agreed between audit and management
- Owner named for each rule
- Data source and completeness checked
- Exceptions routed with deadlines
- Evidence of every run kept
- Independence of audit preserved
- Rules reviewed on a schedule
- Results reported to the audit committee
Frequently Asked Questions
Is continuous auditing the same as continuous monitoring?
No. The techniques are similar, but continuous auditing is owned by internal audit and continuous monitoring by management.
What is continuous assurance?
It is the ongoing assurance internal audit gives the board and senior management on risk management and control, built from continuous auditing and management monitoring.
Does continuous auditing mean real-time auditing?
Not necessarily. "Continuous" can mean daily, weekly or monthly, depending on risk and data.
Can a small firm do continuous auditing?
Yes, on a narrow scope. One or two rules on payments or access are a fair start. Our continuous internal audit guide covers the India context.
Does it remove the need for the annual audit plan?
No. It changes the plan. Areas covered by reliable continuous tests may need less manual work.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error