This requirement exists to ensure defined indicators and monitoring mechanisms for control health, exceptions, and degradation is consistently governed, documented, and capable of producing reliable assurance. Without it, audit activities may be inconsistent, difficult to evidence, or insufficient to support management, regulatory, and stakeholder decisions.
Document the required defined indicators and monitoring mechanisms for control health, exceptions, and degradation; assign accountable roles and approval points; define minimum records and evidence; apply the approved audit methodology and risk criteria; and retain evidence of execution and review. Periodically review the process for changes in organizational risk, regulatory expectations, and audit scope.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| ISO27001 | ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 9.1 – Monitoring, measurement, analysis and evaluation |
ISO
Standard
|
v2022 | View → |
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.16-3.6 – Information Security assessment |
India
Guideline
|
vLatest | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: Circular §13 – Cyber security preparedness indicators; 18) Vulnerability assessment and Penetration Test and Red Team Exercises – 18.4 Management monitoring of VA/PT findings and follow-up actions |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 4.4 Cyber Audit |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 6(6) – Regular internal audit of ICT risk management framework Article 9(1) – Continuous monitoring/control of ICT security and functioning |
EU
Regulation
|
vCurrent | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 5.36 – Compliance with policies, rules and standards for information security |
ISO
Standard
|
v2022 | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(f) – Policies and procedures to assess the effectiveness of cybersecurity risk-management measures |
EU
Directive
|
vCurrent | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.5 – Monitor, Evaluate and Assess (MEA) > MEA02 – Managed System of Internal Control > MEA02.02 – Review effectiveness of business process controls. 4.5 – Monitor, Evaluate and Assess (MEA) > MEA02 – Managed System of Internal Control > MEA02.04 – Identify and report control deficiencies. |
COBIT
Governance Framework
|
v2019 | View → |
| ISO22301 | ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 9.2.1 – General; 9.2.2 – Audit programme(s) |
ISO
Standard
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.OV – Oversight | GV.OV-03 – Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed DE.CM – Continuous Monitoring | DE.CM-09 – Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.4 – ASSESSMENT, AUTHORIZATION, AND MONITORING; CA-7 – CONTINUOUS MONITORING |
NIST
Control Catalog
|
vRev. 5 | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC4.1 – Monitoring of Controls – COSO Principle 16: The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. CC4.2 – Monitoring of Controls – COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate. CC7.2 – System Operations – The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events. |
AICPA
Audit Framework
|
vLatest | View → |