{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Compliance, Audit & Assurance","type":"detective"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-AUDIT-21","description":"Management operates a monitoring program over the system of internal control that combines ongoing evaluations with separate assessments, including management self-assessments and internal audit evaluations. Controls are assessed for design and operating effectiveness on a defined frequency by assessors with a level of independence appropriate to the assessment, under documented assessment plans, and plans for security testing, training exercises, and monitoring are developed, maintained, and executed. Identified deficiencies are evaluated and communicated to those responsible for corrective action, including senior management and the board as appropriate.","details":{"control_category":"administrative","control_type":"detective","domain":"Compliance, Audit & Assurance","guidance":[],"members":[{"control_id":"CA-2","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"PM-14","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"MEA02","coverage":"full","framework":"cobit-2019","relationship":"superset_of"},{"control_id":"ELC-MON","coverage":"full","framework":"sox","relationship":"superset_of"},{"control_id":"P16","coverage":"full","framework":"coso-ic","relationship":"superset_of"}],"statement":"Management operates a monitoring program over the system of internal control that combines ongoing evaluations with separate assessments, including management self-assessments and internal audit evaluations. Controls are assessed for design and operating effectiveness on a defined frequency by assessors with a level of independence appropriate to the assessment, under documented assessment plans, and plans for security testing, training exercises, and monitoring are developed, maintained, and executed. Identified deficiencies are evaluated and communicated to those responsible for corrective action, including senior management and the board as appropriate.","title":"Assess control effectiveness through testing and monitoring","unified_id":"UC-AUDIT-21"},"id":"uc:UC-AUDIT-21","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-AUDIT-21","sourceIds":["cobit-2019","coso-ic","nist-800-53","sox"],"sourceUrl":null,"title":"UC-AUDIT-21 — Assess control effectiveness through testing and monitoring","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0831584982fc979fa7735a75f3cf1123be1a52da6bf9cb2cbfa963f63a12b1e0","properties":{"control_id":"PM-14","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","sourceId":"uc:UC-AUDIT-21","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-pm-14-7b4f513b.json","targetId":"ctrl:nist-800-53:PM-14","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0d8c83f0f15b46b17d8350445b7dbcc50b736d9aeb328a8fb8ce2213749f17ba","properties":{},"sourceDetailPath":"/data/v1/records/wf-s16-ff1d0766.json","sourceId":"wf:S16","targetDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","targetId":"uc:UC-AUDIT-21","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:20a8da436eef1b4a0fbbbe4d5b5bd38b34fd731b712d63eb54a70e05277bf953","properties":{"control_id":"MEA02","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","sourceId":"uc:UC-AUDIT-21","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-mea02-4513eb15.json","targetId":"ctrl:cobit-2019:MEA02","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2d8557480c52ad380a7c58fe80f500f44daf5311d37b2a0eab646aa8adfa0974","properties":{"control_id":"P16","coverage":"full","delta":null,"framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","sourceId":"uc:UC-AUDIT-21","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p16-4995bb68.json","targetId":"ctrl:coso-ic:P16","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3ca60babefbe4859cb18c547ec062fd1e55efbe54db55980034fd45c3b5fd5fa","properties":{"rationale":"Ongoing and separate assessments of controls, with deficiencies routed for corrective action, directly detect and remediate a weak control environment.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","sourceId":"uc:UC-AUDIT-21","targetDetailPath":"/data/v1/records/risk-gov-weak-internal-control-7acb9117.json","targetId":"risk:gov-weak-internal-control","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:42f7d62dce919c0c9cc02eccce6b23626e62094238f787a5b869ff2d3b8e5e39","properties":{},"sourceDetailPath":"/data/v1/records/wf-s25-d145da06.json","sourceId":"wf:S25","targetDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","targetId":"uc:UC-AUDIT-21","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:441f58b0c5473cca79133c40d6c7b615132e02469c56f7c2fad0b9857993e2a0","properties":{"control_id":"ELC-MON","coverage":"full","delta":null,"framework":"sox","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"SOX §302/§404 (2002), PCAOB AS 2201"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","sourceId":"uc:UC-AUDIT-21","targetDetailPath":"/data/v1/records/ctrl-sox-elc-mon-ad9d73ce.json","targetId":"ctrl:sox:ELC-MON","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:44d020fec45fd9e556c9f8bdb1cc1c2e0dbeace4d4dec22b3303ff1fe1182c3b","properties":{"rationale":"Monitoring that assesses control design/operating effectiveness and evaluates and communicates deficiencies (SOX ELC-MON, COSO P16) detects undetected ICFR weaknesses.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","sourceId":"uc:UC-AUDIT-21","targetDetailPath":"/data/v1/records/risk-fin-icfr-material-weakness-cdd66323.json","targetId":"risk:fin-icfr-material-weakness","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4f12201b5119e025490fe5fff1c0927e559c2be40f5300f04ef1181dc11fdfe3","properties":{},"sourceDetailPath":"/data/v1/records/wf-d03-64dbfded.json","sourceId":"wf:D03","targetDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","targetId":"uc:UC-AUDIT-21","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:521868ef074e66cc935740c622000ce297950a82e21cc8217c26b72631a0d230","properties":{},"sourceDetailPath":"/data/v1/records/wf-s21-9e073747.json","sourceId":"wf:S21","targetDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","targetId":"uc:UC-AUDIT-21","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:565d8552d9b72186db1f77948205d9c27bbef3e77114c8497fac7b4f712b5e3c","properties":{},"sourceDetailPath":"/data/v1/records/wf-d05-2302db1f.json","sourceId":"wf:D05","targetDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","targetId":"uc:UC-AUDIT-21","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:59d967448f11f083148dba7f759a91231c256af783d933c0cd98616173e1f852","properties":{},"sourceDetailPath":"/data/v1/records/wf-c7-acbef2ee.json","sourceId":"wf:C7","targetDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","targetId":"uc:UC-AUDIT-21","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5fecdde0f923985767950a37193ed01275b0d7fc1c6dd9343f7c77b5cb4e6049","properties":{},"sourceDetailPath":"/data/v1/records/wf-s20-9a700642.json","sourceId":"wf:S20","targetDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","targetId":"uc:UC-AUDIT-21","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6b8209a15daa3abbfd30deb9b12d11d8dedbf0492f35b2c9bcc682d132dc770a","properties":{},"sourceDetailPath":"/data/v1/records/wf-d04-01080a77.json","sourceId":"wf:D04","targetDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","targetId":"uc:UC-AUDIT-21","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:709ed16785da182809c3ff2465102037fa69991bdd6d5efc680974efd25006bc","properties":{},"sourceDetailPath":"/data/v1/records/wf-d58-e187aaba.json","sourceId":"wf:D58","targetDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","targetId":"uc:UC-AUDIT-21","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7150b152c28010ef88cc72ea38a7b9d3645c2ca01ccc07f126c94861b540b9c3","properties":{},"sourceDetailPath":"/data/v1/records/wf-s5-a655abf2.json","sourceId":"wf:S5","targetDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","targetId":"uc:UC-AUDIT-21","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:777f84151a09a9cd3e2cfdd8c2ce5778af50f01c644001e564adb709c745f2e8","properties":{},"sourceDetailPath":"/data/v1/records/wf-c9-75fb1752.json","sourceId":"wf:C9","targetDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","targetId":"uc:UC-AUDIT-21","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7b10fc743335e8972667df88f430de8e82daa8b1f1e38310d0c8171abfdd6810","properties":{},"sourceDetailPath":"/data/v1/records/wf-d59-b3ddf606.json","sourceId":"wf:D59","targetDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","targetId":"uc:UC-AUDIT-21","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7ba3e9072ed91dfeb660e6a18b40a5be5ecf201999fd6b8d0e1fb5f2078b346a","properties":{},"sourceDetailPath":"/data/v1/records/wf-c8-5634a289.json","sourceId":"wf:C8","targetDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","targetId":"uc:UC-AUDIT-21","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:85589de9504df1da0f902ae4eb7ffe97fd001f623e1c0ebcdaeef7d4edcaf497","properties":{},"sourceDetailPath":"/data/v1/records/wf-d57-31008e44.json","sourceId":"wf:D57","targetDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","targetId":"uc:UC-AUDIT-21","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:964ecd8450a1658763c3eff7c1f52e19b196ba077a9a76a51d22a88d447186d6","properties":{},"sourceDetailPath":"/data/v1/records/wf-c1-f9e3db77.json","sourceId":"wf:C1","targetDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","targetId":"uc:UC-AUDIT-21","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ab8cc032370087d785d58ed2dbf3e925564654122556f632fb10020b231bc440","properties":{},"sourceDetailPath":"/data/v1/records/wf-d01-41c8c187.json","sourceId":"wf:D01","targetDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","targetId":"uc:UC-AUDIT-21","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:adbbb3644e9e37df21de61aace7d8f3c75aad933f5900ddfb953bee57a40f8ec","properties":{},"sourceDetailPath":"/data/v1/records/wf-s6-7962d7b6.json","sourceId":"wf:S6","targetDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","targetId":"uc:UC-AUDIT-21","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:affa96d60a0c6650e6acffcdae794e4e047b037bbe48c8bc03ceb58a61c06483","properties":{},"sourceDetailPath":"/data/v1/records/wf-s8-45ab5a56.json","sourceId":"wf:S8","targetDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","targetId":"uc:UC-AUDIT-21","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c5ca450407a65fd8034110d96dab2be3ef9bb93c658f7d973e58e18811d0b89d","properties":{},"sourceDetailPath":"/data/v1/records/wf-c17-334c380f.json","sourceId":"wf:C17","targetDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","targetId":"uc:UC-AUDIT-21","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d78c10aa374fb1eaabeeb2e689e003e596e313c0cb8869c6f7bc90460edc6230","properties":{"control_id":"CA-2","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","sourceId":"uc:UC-AUDIT-21","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-ca-2-dadbdc82.json","targetId":"ctrl:nist-800-53:CA-2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:eb4584970a3d10a43b8e6b52a71626665c9a47c8f2baca3126259e6676457b3c","properties":{"rationale":"Independent testing of control operating effectiveness can detect management override and fraudulent transactions.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","sourceId":"uc:UC-AUDIT-21","targetDetailPath":"/data/v1/records/risk-fin-financial-statement-fraud-1dd35d5a.json","targetId":"risk:fin-financial-statement-fraud","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f548dcf62296403ce93a34a02d7d67065e11853f4eb015de319788967fe45bfb","properties":{},"sourceDetailPath":"/data/v1/records/wf-s19-af8aa969.json","sourceId":"wf:S19","targetDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","targetId":"uc:UC-AUDIT-21","type":"tests"}],"schemaVersion":1}