Continuous controls monitoring: a buyer’s guide
Continuous controls monitoring promises to test every transaction, every day. Before you buy, know which controls to start with, what an alert should look like and who will act on it.
Continuous controls monitoring (CCM) tests your controls with data, all the time, instead of once a year with a sample. Done well, it finds problems while they are still small. Done badly, it produces thousands of alerts nobody reads.
This guide is about doing it well.
Start with the money, not the framework
The temptation is to automate every control in the risk register. Resist it. Start with the controls where a failure costs money directly:
- Duplicate and unusual payments
- Vendor master changes, especially bank details
- Segregation of duties in purchase-to-pay
- Credit notes, discounts and price overrides
- Journal entries posted outside normal patterns
Five well-chosen controls that produce valued findings will earn the budget for the next fifty.
Questions to ask any vendor
What does an alert look like?
An alert should say what happened, how much it is worth, who owns it and which transactions prove it. If the answer is a row in a spreadsheet, the work of turning it into a finding falls on your team.
How much noise will we get?
Ask for false-positive rates from a real deployment, and how they fell over the first three months. Tuning is not optional; it is most of the work.
Who does the tuning?
Somebody has to adjust thresholds, add exceptions and retire tests that no longer help. Know whether that is you, the vendor or both.
How does it connect to our systems?
Read-only extraction from the ERP is standard. Ask how often the data refreshes, what happens when a field changes and who fixes a broken connector.
Where does our data live?
Many finance and audit teams need their data to stay in their own cloud or data centre. Ask whether the software can run there.
What good looks like after 90 days
| Measure | Healthy sign |
|---|---|
| Controls live | 5 to 15, chosen by value |
| Alerts closed by owners | Most within the agreed time |
| False positives | Falling month on month |
| Findings with a value | Reported to the audit committee |
Pilot before you commit
A short, fixed-price pilot on your own data tells you more than any demo. Ask for one that ends with valued findings, not a configured tool. That is what our LaunchPad for continuous controls is built to do, and CompliBear keeps the controls running afterwards.