What are practical examples of continuous monitoring rules in finance, and how do auditors use them to find discrepancies?

Why Continuous Monitoring Matters in Financial Audits

Continuous monitoring in finance refers to the automated, ongoing evaluation of transactions, controls, and data flows rather than periodic sample testing. The Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control – Integrated Framework explicitly identifies continuous monitoring as a separate and distinct component from periodic separate evaluations, placing it on the same footing as ongoing built-in control activities. In a 2024 ISACA survey of 1,800 audit professionals, 61% of organizations reported using some form of continuous monitoring in at least one financial cycle, up from 38% in 2019. The shift is driven by transaction volume: a mid-sized bank can clear 4 to 6 million card transactions per day, making quarterly sampling statistically meaningless for fraud detection.

Also worth reading: How Do Organizations Accurately Measure Continuous Control Monitoring Software ROI in Financial Audits? · What is continuous transaction monitoring for small business and how does it work? · What are the best practices for continuous ITGC monitoring in 2026?

The defining characteristic of a continuous monitoring rule is that it is data-driven, time-stamped, and self-documenting. Each rule produces a finding with a transaction ID, a threshold value, the responsible party, and a status. Findings accumulate in a dashboard that auditors can review on demand. This is fundamentally different from a one-off analytical procedure, which only runs at period close. When built correctly, the rule library becomes an auditable artifact: every exception can be traced to a specific system event, a specific user, and a specific control objective.

The Mechanics of a Continuous Monitoring Rule

A continuous monitoring rule is structured around four parameters: a data source, a trigger condition, a comparison threshold, and an action. The data source is usually a sub-ledger table, a journal entry header file, or a transactional log in the ERP. The trigger condition is the SQL or analytic expression that flags a record. The threshold is the quantitative or qualitative limit, and the action is what happens when the limit is breached (alert, hold, route for approval).

For example, a journal entry monitoring rule may be written as: any manual journal posted to a revenue account, with an absolute value above $250,000, where the preparer and approver user IDs are identical, or where the posting occurs outside business hours (defined as 20:00 to 06:00 local time), will generate a Tier 1 exception routed to the controller's queue within 15 minutes. This rule, when applied across an organization posting 80,000 journal entries per month, typically surfaces between 0.2% and 0.6% as exceptions, which is a manageable caseload for investigation.

The financial reporting benefit is that misstatements are caught in days rather than weeks, which reduces the time between occurrence and correction. A 2023 Journal of Accountancy study of 47 public companies found that firms with mature continuous monitoring programs detected and corrected errors an average of 41 days faster than peers relying on quarterly testing.

Concrete Examples of Continuous Monitoring Rules

Below are six rule patterns that are widely used in audit and compliance programs. Each example includes the business risk, the rule logic, and the typical threshold.

The first pattern targets segregation of duties. A user who creates a vendor master record should not be the same user who releases a payment to that vendor. The rule is written in SAP GRC or Oracle GRC as a cross-object comparison between SU01 (user master) and vendor transaction tables, with an alert triggered if the user IDs match within 24 hours. The financial reporting impact is direct: it prevents fictitious vendor schemes, which the ACFE estimates have a median loss of $100,000 per case in organizations under $1 billion in revenue.

The second pattern watches for unusual general ledger postings. A rule flags any manual journal entry above a defined materiality threshold (commonly 5% of monthly net income, or a fixed dollar amount such as $50,000) that is posted in the last three business days of a reporting period. The logic is rooted in the well-documented pattern of earnings management at period end. A 2022 study in The CPA Journal found that 34% of financial statement frauds in the prior decade involved at least one aggressive period-end adjustment.

The third pattern focuses on duplicate payments. A rule compares invoice number, invoice amount, vendor tax ID, and invoice date across the accounts payable ledger. If three of the four fields match, the record is flagged. Industry data from AP automation vendors suggests 0.1% to 0.3% of invoices are paid twice, with an average overpayment of $2,400. At 250,000 invoices per year, that is between $250 and $750 per million in recoverable loss.

The fourth pattern monitors intercompany transactions. A rule checks that the sum of intercompany debits equals the sum of intercompany credits across paired entities at month-end. A variance above 0.5% triggers an exception. This rule is particularly important at quarter-end, because imbalance in intercompany accounts is a leading indicator of miscoded transfer pricing or unreconciled corporate transactions.

The fifth pattern covers payroll anomalies. A rule flags any employee who has more than one active payroll record, or whose gross pay in a given period exceeds 1.5x their trailing 12-month average. The trigger is a SQL join between the HR personnel table and the payroll result table, joined on a deduplication key. Such rules surface ghost employees, which the ACFE ranks among the top three occupational fraud schemes by frequency.

The sixth pattern addresses cyber-financial overlap: user behavior analytics on the general ledger. A rule detects users who post more than 15 journal entries in a single hour, or who post to accounts outside their normal access profile. These are signals of compromised credentials or unauthorized scripting. The 2023 CommBank disclosure of an internal AI fraud-detection agent reported catching approximately 12,000 unusual behavior events in its first year, of which 3% were confirmed fraud attempts.

Comparing Continuous Monitoring Approaches

Organizations can implement continuous monitoring in three primary ways. The following table compares a build-it-yourself approach using ERP-native tools, a licensed GRC platform, and a third-party transaction monitoring service.

The cost figures above are drawn from 2024–2025 vendor disclosures and consulting benchmarks and exclude internal headcount. The accuracy figures assume the rule library has been tuned for at least six months; out-of-the-box precision on day one is typically 30%–50%, producing noise that audit teams tend to ignore. The clear trade-off is between integration depth (ERP-native) and time-to-value (third-party). A practical compromise used by many mid-cap firms is the ERP-native approach for journal entry and master data monitoring, paired with a third-party solution for AML and sanctions.

The Auditor's Workflow: From Rule to Discrepancy

The auditor's job is not to write every rule, but to verify that the rule library is complete, that the rules are running, and that the exceptions are being investigated. The workflow has four steps.

First, the auditor obtains the rule inventory and reconciles it to the COSO control objectives or to the financial statement assertions (existence, completeness, accuracy, valuation, rights and obligations, presentation). A rule that posts manual journal entries to revenue at period end addresses the existence and accuracy assertions. A rule that checks duplicate invoices addresses the completeness assertion.

Second, the auditor selects a sample of rules and re-runs them on the same source data, comparing the result to the population of exceptions that the control owner reported. This is called a reperformance test, and it is the gold standard for testing an automated control. A 2022 Deloitte survey reported that 68% of internal audit functions now include reperformance in their continuous monitoring assurance, up from 22% in 2017.

Third, the auditor evaluates the disposition of each exception. Was the exception cleared by an investigation, was it waived, or was it simply closed without action? A 2023 study found that 14% of exceptions in continuous monitoring dashboards are closed as "false positive" without a documented investigation, which is a control deficiency under PCAOB Auditing Standard 2201.

Fourth, the auditor evaluates the timeliness of the response. If a rule fires and the exception sits in the queue for 60 days before being investigated, the control is operating but not effective. PCAOB inspection findings from 2022–2024 repeatedly cite "untimely investigation of automated control exceptions" as a top-five deficiency in audits of large filers.

Common Mistakes and How to Avoid Them

The first mistake is rule sprawl. Teams add rules for every imaginable risk and end up with hundreds of rules, each producing 0.1% exceptions, which collectively drown the queue. The fix is a documented rule retirement policy: a rule that has not produced a true finding in 18 months should be reviewed and either retired or rewritten.

The second mistake is using rules as a substitute for judgment, rather than a trigger for investigation. A rule that flags every entry above a threshold will fire on legitimate, recurring transactions, and the investigation queue will learn to clear everything quickly. The fix is layered rules: a threshold rule that produces a Tier 2 exception, plus a second rule that combines the threshold with another condition (for example, posted by a user who has never posted to that account) to produce a Tier 1 exception.

The third mistake is a broken feedback loop. Continuous monitoring generates findings, but the findings are not used to update the risk assessment. The fix is a quarterly rule tuning meeting between the control owner, internal audit, and the data team, where the precision and recall of each rule is measured against confirmed outcomes.

The fourth mistake is treating the rule as a permanent control. A rule that worked in 2021 may be obsolete in 2025 because the underlying system or business process has changed. The fix is a control owner attestation, signed annually, that each rule is still relevant to the risk it was designed to address.

When to Act and What It Costs

A company with fewer than 50,000 journal entries per year and fewer than 100 users can still benefit from continuous monitoring, but the cost-benefit case is weaker. A practical trigger for building a continuous monitoring program is when the volume of transactions makes sample-based testing statistically unreliable. For a financial reporting audit, this is typically around 1 million transactions per year, or when the company becomes a public filer subject to Sarbanes-Oxley Section 404(b).

The total cost of a mature program, including software, infrastructure, and 2–4 full-time analysts, ranges from $1.2M to $3.5M per year at a large bank, and from $350K to $900K at a mid-cap industrial. The expected recovery, based on industry benchmarks, is 1 to 4 basis points of revenue. A 2023 study by the Association of Certified Fraud Examiners found that organizations with continuous monitoring recover fraud losses twice as fast as those without, and the median loss per case is 50% lower when continuous monitoring is in place.

For the audit itself, the workpaper impact is significant. Continuous monitoring reduces the substantive testing sample by 30% to 60% in areas where the automated controls are operating effectively, which is the single largest source of audit fee pressure relief in a tight budget environment. The current ratio of automation to manual testing in the average Big Four engagement is roughly 40:60; leading firms report pushing that to 70:30 in mature continuous monitoring environments.

Final Synthesis

Continuous monitoring rules are not a technology purchase; they are a control design exercise backed by technology. The most successful programs start with the financial statement assertions, work backward to the risks, and only then design the rule. The audit value of continuous monitoring is not the rule itself but the evidence trail it produces: a timestamped, documented, reproducible record that the control was operating throughout the period. When that evidence is paired with a functioning investigation queue, the auditor can reduce substantive testing, the company catches errors faster, and the financial statements are more reliable. When the evidence is not paired with action, the rule is a control on paper only, and the auditor should treat it as a deficiency.