Understanding the difference between auditing and monitoring

The following statements made me ask myself what the difference between auditing and monitoring is:-

• Increasingly, we are now seeing larger TCSPs looking to establish in-house or outsourced internal audit functions and
• This is partly being driven by regulators as AML laws and regulations will often require an independent AML internal audit to be conducted and
• Many firms are looking at how to combine these efforts to deliver greater levels of assurance.

Here are some thoughts to answer my question

MONITORING

Ongoing monitoring should be

• A continuous control, monitoring process and method to detect compliance risk issues associated with an organisation’s operations.

Ongoing monitoring program responsibilities include:-

• Keeping current with changes in rules, regulations, and applicable laws;
• Developing internal controls, policies, and procedures to comply with them;
• Training staff on these rules; and
• Taking steps to monitor or verifying compliance with these new guidelines.

Monitoring programs will have tests for:-

• Inconsistencies,
• Duplication,
• Errors,
• Policy violations,
• Missing approvals,
• Incomplete data,
• [$/£] transaction/volume limit errors and/or
• Other possible breakdowns in internal controls.

Monitoring techniques may include:-

• Sampling protocols permit program managers to identify and review variations from an established baseline.

AUDITING

Ongoing auditing entails:-

• Reviewing the continuous monitoring process and verifying it is effective in achieving the desired outcome.

When it comes to high-risk compliance areas within an operation, audit objectives are to:

• Verify that managers are meeting their obligations for ongoing monitoring; and
• Validate that the process is achieving desired outcomes; this includes confirming that controls are in place and functioning as intended or identifying weaknesses in the program that need to be addressed.

An audit must be an independent and objective review, which means it should be done by people external to the program area to be audited and can be done by:-

• The compliance office,
• Internal or audit department,
• Other program managers, or any combination thereof.
• External reviewers, such as consultant experts or operational auditors, can also be used.

COMPLIANCE OFFICER

• In any case, the Compliance Officer should ensure that the monitoring and auditing are taking place and doing what they should be doing.

Sourced from =

• https://www.compliance.com/resources/compliance-officers-responsibility-ongoing-auditing-monitoring-high-risk-areas/