Continuous monitoring works when rules are specific enough to run on real ERP data and documented enough to survive internal-audit review. This repository lists practical rule logic, data fields, exception examples and cadence choices for common Indian internal audit cycles.
A monitoring rule is not just a query. It is a documented audit procedure with a population, source, logic, threshold, reviewer conclusion and follow-up trail.
Flag same supplier + invoice number + amount, and near-duplicates where invoice number differs only by spaces, prefixes or separators.
Cadence: Weekly for active AP teams; monthly for low-volume entities.
Related RCM ->Flag MSME invoices outstanding beyond the agreed/statutory credit period and paid invoices with delayed settlement.
Cadence: Weekly during close and before tax audit finalisation.
Related RCM ->Flag invoices or orders processed where exposure exceeds approved credit limit without documented approval.
Cadence: Weekly for trading/manufacturing entities.
Related RCM ->Flag manual journals posted after the close cut-off, large journals, blank narrations and creator-approver conflicts.
Cadence: Daily during close week; monthly otherwise.
Related RCM ->Flag unreconciled receipts/payments older than the approved ageing threshold, separated by debit and credit side.
Cadence: Monthly minimum; weekly where cash leakage risk is high.
Related RCM ->Flag salary, reimbursement or incentive paid after recorded exit date except approved full-and-final settlements.
Cadence: Monthly before salary release.
Related RCM ->Flag negative closing quantities, no-movement stock beyond threshold and items where NRV marker is below cost.
Cadence: Monthly; weekly for multi-location inventory.
Related RCM ->Flag facilities where covenant ratios are breached or within the warning band defined by treasury policy.
Cadence: Monthly and before lender reporting dates.
Related RCM ->Flag late filings, missing challans, nil returns filed despite ledger activity and interest/late fee not booked.
Cadence: Monthly close and quarterly audit committee reporting.
Related RCM ->Flag active user IDs for exited employees and privileged activity without ticket or approval reference.
Cadence: Monthly; weekly for finance-admin roles.
Related RCM ->Lock the population: save the source report, extraction date, filters and completeness check.
Run the rule: retain the rule logic, threshold and exception count before manual exclusions.
Clear false positives: document exclusions and why they do not indicate a control issue.
Investigate validated exceptions: obtain source documents, owner explanation and financial/compliance impact.
Report only concluded issues: convert validated exceptions into observations, ratings and ATR follow-up.
Monitoring is useful only when the exception can move into a workpaper. These cycle workbooks export the RCM, testing sheet, exception register and reviewer fields auditors need for follow-up.
Continuous monitoring rules are repeatable exception tests applied to recurring business data. They flag transactions, balances or master-data changes that need internal-audit review, such as duplicate invoices, stale BRS items, leaver access or late statutory filings.
No. A rule exception is only a flag. The auditor still needs to verify the population, validate the logic, review false positives, obtain evidence, assess root cause and then decide whether an observation should be reported.
P2P, O2C, R2R, cash and bank, payroll/H2R, inventory, treasury, statutory compliance and ITGC work well because they generate structured data on a recurring cadence.
