Continuous Controls Monitoring

Continuous controls monitoring (CCM) is the automated, ongoing testing of whether internal controls are operating effectively, rather than sample-based testing once or twice a year. Rules run against the whole population of transactions or records on a defined cycle and raise an exception where a control has failed.

Declared coverage is what a rule set asserts it reaches. Evidenced coverage is what a run actually tested. The difference is the exclusion set: records missed because a connector timed out, a period was not closed, a company code was unreadable, or the rule's own filter removed them. A coverage claim without an exclusion set cannot be checked.

It writes the tests. Authoring several hundred control tests by hand is the work that sinks monitoring programmes, so the agent turns a written control description into an executable specification against your own schema, and proposes which source fields hold the data it needs. It then collapses thousands of exceptions into a handful of root causes and drafts the finding in the structure your audit function already writes to. Every proposal carries its evidence and a person confirms it, which is what makes the output usable in an audit file rather than only impressive in a demo.

Bring the rules you already have. A test sheet, an analytics script or an export from an incumbent tool imports into the structured specification, and the agent drafts new rules from your written control descriptions. The first cycle runs on the sources already connected, and each rule states its own coverage from its first run.

No. The same evidence record serves financial, environmental, health and safety, asset integrity, workforce and access controls. A weighbridge ticket, a permit to work, a calibration certificate and a journal entry are all populations that can be tested continuously.

No. It runs on top of it. The host keeps its control library, its workflow and its remediation. We read the library, write findings back as drafts, and receive closure as an event.

A baseline rule derives its limit from the population's own history instead of a fixed threshold. It stays reproducible: same window, same data, same result, and the computed baseline is written into the run record so a re-performance produces identical figures. Outliers are recorded as observations rather than exceptions, because nothing was breached and there is no criterion to cite.