ICS Monitoring Agent

Only around 40 percent of companies rate their own internal control system as effective - according to a Deloitte study among listed and large non-listed companies. At the same time, corporate governance law requires management to establish a monitoring system that detects existential threats early. (US: SOX Section 302/404 imposes comparable requirements for publicly traded companies.) The gap between obligation and effectiveness almost always arises at the same point: the ICS is defined but never continuously monitored.

Periodic Testing Misses Control Failures Between Cut-Off Dates

Most organisations test their ICS quarterly or at year-end. What happens between testing dates stays invisible. An approval limit is temporarily raised and never reset. A delegation arrangement suspends the four-eyes principle for three weeks. A new employee receives authorisations that violate the segregation-of-duties matrix.

These are not edge cases. They are the norm in organisations whose control system relies on manual, periodic testing. The statutory auditor assesses ICS effectiveness per ISA 315 and adjusts the audit scope accordingly. An ICS that only works at the cut-off date leads to extended testing and higher audit fees.

Continuous monitoring closes this time window. Every transaction is checked against defined control activities - not once a quarter, but at every posting.

Missing Segregation of Duties Causes the Largest Individual Losses

Segregation of duties is one of the most effective controls against fraud. According to the ACFE Report to the Nations 2024, more than 50 percent of all cases of Occupational Fraud are attributable to missing or circumvented internal controls - structured segregation of duties is one of the most effective countermeasures. The consequence: the average loss per case, according to ACFE 2024, is around USD 1.7 million, based on an analysis of 1,921 documented fraud cases across 138 countries.

A concrete scenario: an employee in procurement creates a vendor, enters the purchase order and approves the invoice for payment. Three roles, one person. In an ERP system with organically grown authorisation structures, this conflict often goes undetected for years because nobody systematically checks the authorisation matrix against actual role assignments.

The ICS Monitoring Agent checks at every transaction whether the executing person has a segregation-of-duties conflict. Not as a sample, but comprehensively. Every conflict is documented and escalated according to defined thresholds.

Continuous Monitoring Shifts Audit Logic from Sampling to Full Population

The COSO framework defines monitoring as a stand-alone component of the internal control system - equal in rank to control environment, risk assessment, control activities and information. In practice, monitoring is the component most frequently neglected because it generates the highest ongoing effort.

An agent changes this equation. It checks control activities rule-based: was the four-eyes principle observed, is the approval within the limit, does the authorisation match the matrix. Simultaneously, it detects anomalies in transaction data - unusual posting patterns, clusters just below approval thresholds, conspicuous timestamps.

The result is an ICS report based not on samples but on the examination of every single transaction. For the statutory auditor, this means: reliable evidence of control system effectiveness across the entire audit period.

The Decision Layer Separates Automated Control from Human Escalation

Not every ICS decision lends itself to automation. Checking the four-eyes principle against a checklist - that is a rule engine, tier 1. Detecting anomalies in transaction data - that requires AI analysis, tier 2. But the decision of how to escalate when a control failure is detected stays with the human.

This separation is not a technical detail. It is the prerequisite for the statutory auditor to accept automated monitoring as audit evidence. Every control check is documented: what was checked, what the result was, what action follows. On failure, the agent logs the affected transactions, the nature of the violation and the escalation path.

The compliance officer decides on the corrective measure. The agent monitors whether the decided measure is implemented. This creates a closed loop - from control definition through testing to follow-up.