When should continuous monitoring belong to management instead of internal audit?

Continuous monitoring should belong to management when it is part of running the process or detecting exceptions that management must investigate in the normal course of business. For example, if a monthly dashboard flags unauthorized discounts for branch managers to resolve, that is a management monitoring control.

Internal audit may use analytics to identify risk, select samples, prototype a useful monitor, or perform follow-up. But if the organization relies on the dashboard as a control, management should own the rules, review cadence, evidence of follow-up, and remediation decisions. Internal audit can later assess whether that monitoring control is designed and operating effectively.

The independence issue is practical: internal audit should not become the permanent operator of a control it later audits.