Internal audit, continuous monitoring and the monthly MIS answer three different questions. The MIS tells management what happened last month. Continuous monitoring tells a named person what needs attention now, by checking every transaction against a set of rules. Internal audit tells the board, independently, whether the controls behind both can be relied on.
They are confused because all three produce a report with exceptions in it. This guide separates them: who reads each, how often, what each can and cannot tell you, and why none replaces another. It is written for CFOs, finance controllers, heads of internal audit and audit committee members.
If you want the working file rather than the explanation, start here:
| Need | Use this |
|---|---|
| The monthly management pack in Excel, with an exceptions sheet | MIS Report Format Generator |
| A starting list of exception rules by process, with cadence and owner columns | Internal Audit Monitoring Rules |
| Management's own check of its finance controls before anyone audits them | Finance Controls Health Check |
Three different things a company can have
1. The monthly management pack: what happened
The MIS is the pack finance prepares after the month-end close: profit and loss against budget and last year, cash, working capital, the main ratios, and commentary. It is read by the promoters, the CFO, business heads and the board.
What it can tell you. Whether the business is on plan, which lines caused the gap, and where the cash is sitting.
What it cannot tell you. Whether the numbers under it are right. An MIS reports totals. A vendor paid twice or an order released over a credit limit is inside the totals and invisible in them. And by the time the pack shows a problem, the transaction is weeks old.
2. Ongoing exception monitoring: what needs attention now
Monitoring is a set of rules run across every transaction as it is recorded, or at a fixed short interval. A bill matching an earlier one on vendor, amount and invoice number. A receivable crossing its credit period. A change to a vendor's bank account followed by a payment. Each hit goes to a named owner with a date by which it must be cleared or explained.
It is read by the people who can act: the finance controller, the accounts payable and receivable leads, process owners — and the CFO in summary.
What it can tell you. That a specific transaction broke a specific rule, close to the day it happened, across the whole population rather than a sample.
What it cannot tell you. Anything it has no rule for. It does not judge whether a process is well designed, whether people are getting round a control off the system, or whether the rules are still the right ones. And when management runs it, it is management checking itself.
3. The periodic internal audit: whether the controls work
Internal audit is an independent review of the company's functions and activities, done to a plan the audit committee or board has approved, and reported to them. The internal auditor looks at how a process is designed, tests whether its controls operated, finds the cause of what went wrong, and follows up whether management fixed it.
It is read by the audit committee and the board, with management receiving the detailed observations.
What it can tell you. Whether a control exists, is designed sensibly and worked over the period — and why it failed where it did. It reaches things no transaction rule can see: segregation of duties, override by senior people, a contract that was never tendered, a reconciliation signed without being done.
What it cannot tell you. What happened yesterday. An audit is periodic and covers the areas in that year's plan. Between two visits to the same process, a year or more can pass.
Side by side
| Monthly MIS | Continuous monitoring | Internal audit | |
|---|---|---|---|
| Question answered | What happened? | What needs attention now? | Do the controls work? |
| Prepared by | Finance | Finance or a control function; sometimes internal audit | Internal auditor — in-house or an outside firm |
| Read by | Promoters, CFO, business heads, board | Process owners, finance controller, CFO | Audit committee and board; management for action |
| How often | Monthly, after the close | Daily or weekly; at least before each close | To the approved plan — typically each area once in a cycle |
| Looks at | Totals and trends | Every transaction, against set rules | Process design, controls, a tested selection, causes |
| Output | Variances, commentary, decisions | An exception with an owner and a closure date | Observations with cause, effect, recommendation and management response |
| Independent of management? | No | No, when management runs it | Yes — that is its purpose |
| Blind spot | Errors inside the totals | Anything without a rule; anything off the system | Anything outside this year's plan; anything since the last visit |
| Required by law? | No prescribed format | No | Yes, for the classes of company covered by Section 138 |
One problem, seen three ways
An illustrative example. In August, a supplier's bill for ₹4.20 lakh is entered twice — once as "INV/2231" and once as "2231" — and both are paid.
- The MIS for August shows repairs and maintenance ₹4.20 lakh over budget on a line of about ₹60 lakh. It is 7% adverse, flagged amber, and the commentary says "higher maintenance activity." Nobody is wrong to accept that.
- Monitoring flags the second bill on the day it is entered: same vendor, same amount, invoice numbers that match once the prefix is removed. The accounts payable lead is the owner, with five days to clear it. The payment is stopped, or recovered from the next bill.
- Internal audit, reviewing procure-to-pay in the third quarter, asks a different question: why could the same invoice be entered twice? It finds that the system's duplicate check compares the invoice number exactly, that direct bills skip the purchase-order match, and that nobody reviews the exceptions. It reports the gap to the audit committee with a recommendation, an owner and a date, and checks later that it was fixed.
The MIS saw the effect. Monitoring caught the transaction. Internal audit found the cause and told the board. Each did something the other two could not.
Why one does not replace another
"We have a good MIS, so we know what is going on." You know the totals. The pack is built from the books, and it cannot tell you the books contain a wrong entry.
"We monitor every transaction, so we do not need an internal audit." Full coverage of transactions is not full coverage of risk. Monitoring tests what can be expressed as a rule on data. It also raises the question of who checks the rules, the completeness of the data and whether exceptions are genuinely closed. That is an audit question. And where the law requires an internal auditor, a dashboard does not discharge it.
"Internal audit covers this, so finance need not look." Internal audit reports after the fact, on the areas in the plan. Finding problems as they happen is management's job.
The three build on each other. Monitoring keeps errors out of the close and gives the MIS its exceptions sheet. Internal audit then spends less time finding individual errors and more on design, cause and the areas no rule can reach.
Who should own the monitoring
Usually management — finance or a control function — because the owner must be able to fix what is found. Internal audit can design rules, run its own tests on the same data, and review how exceptions were closed. It should not own the closure of exceptions it will later give assurance on. The three lines assurance map is a way to set this out.
For how internal audit builds monitoring into its own procedures, see continuous monitoring in internal audit, continuous internal audit and full-population testing and the continuous audit guide. This piece does not repeat them.
What the audit committee still needs from internal audit
A live view of exceptions is useful to an audit committee. It is not what the law asks the committee to rely on.
The appointment is a legal requirement for many companies. Section 138 of the Companies Act, 2013 requires prescribed classes of companies to appoint an internal auditor — a chartered accountant, a cost accountant, or another professional the Board decides on — to audit the functions and activities of the company. Rule 13 of the Companies (Accounts) Rules, 2014 sets the classes: every listed company; an unlisted public company with paid-up share capital of ₹50 crore or more, turnover of ₹200 crore or more, loans or borrowings from banks or public financial institutions exceeding ₹100 crore, or deposits of ₹25 crore or more; and a private company with turnover of ₹200 crore or more or such borrowings exceeding ₹100 crore, measured on the preceding financial year. The applicability checker runs the test.
The committee sets the scope. Under Rule 13, the audit committee or the Board, in consultation with the internal auditor, formulates the scope, functioning, periodicity and methodology of the internal audit. No dashboard can make that decision.
The committee oversees controls. Section 177 requires an audit committee in listed companies and prescribed classes of public companies. Among its functions, it may call for the auditors' comments on internal control systems, review the scope of audit, and discuss issues with the internal and statutory auditors and management.
The statutory auditor's opinion is separate. Under Section 143(3)(i), the statutory auditor reports on whether the company has an adequate internal financial controls system and whether it operated effectively. That is a different party and a different obligation. Internal audit work can be an input to it; it is not a substitute.
So the committee still needs from internal audit what a monitoring screen cannot give:
- An independent view. Someone who does not report to the people being reviewed.
- A plan the committee approved, and a report on what was covered, what was not, and why.
- An opinion on design, not only a count of exceptions.
- Cause. Why the control failed, and whether the same cause sits behind other findings.
- Assurance over the monitoring itself — are the rules sensible, is the data complete, are exceptions closed with evidence or simply marked closed?
- Follow-up. Whether management did what it agreed to, by when.
- The areas with no transaction trail — related-party dealings, large contracts, access to systems, management override.
Regulated entities such as banks and NBFCs carry their own, stricter internal audit requirements on top of the Companies Act.
If you are building this from nothing
First get the close and the MIS reliable. Next pick a handful of exceptions that cost real money — duplicate payments, overdue receivables, changes to vendor bank details — and give each an owner. Then run the health check and share the result with your internal auditor. Tools such as CORAA's enterprise intelligence view sit in the middle layer: an executive dashboard for management, not an internal audit.
Internal audit vs monitoring vs MIS FAQ
What is the difference between internal audit and continuous monitoring?
Internal audit is a periodic, independent review of whether controls are designed and working, reported to the audit committee or board. Continuous monitoring is an ongoing check of transactions against rules, usually run by management, that sends each exception to an owner to fix.
Does continuous monitoring replace internal audit in 2026?
No. Monitoring covers what can be written as a rule on data and is normally run by management itself. It does not provide the independent assurance the board needs, and for companies covered by Section 138 it does not meet the requirement to appoint an internal auditor.
What is the difference between internal audit and MIS?
An MIS is management's monthly report on results, cash and working capital. Internal audit is an independent examination of the processes and controls that produce those numbers. The MIS says what happened; internal audit says whether the system behind it can be trusted.
Who should own continuous monitoring — finance or internal audit?
Management, in most companies, because the owner has to act on the exceptions. Internal audit can help design the rules and should review how exceptions are closed, but it should not own closure of items it later gives assurance on.
Is internal audit mandatory for a private company?
Yes, if the private company had turnover of ₹200 crore or more, or outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore, in the preceding financial year. Below those limits it is voluntary, though lenders and investors often ask for it.
Related CORAA resources
- MIS Report Format Generator
- Internal Audit Monitoring Rules
- Finance Controls Health Check
- Internal Audit Applicability Checker
- Continuous monitoring in internal audit: procedures, RCM and dashboard design
- Audit committee questions for internal audit
Sources
- Companies Act, 2013 — Sections 138, 143 and 177, Ministry of Corporate Affairs
- Companies (Accounts) Rules, 2014 — Rule 13, on the classes of companies required to appoint an internal auditor and on scope, functioning, periodicity and methodology