A practical guide to COSO Monitoring Activities, Principles 16 and 17, evaluations, deficiency management, evidence, remediation, and GRC traceability.
Published: 9/3/2026Updated: 9/3/2026By growGRC Editorial Team
Executive Summary
Monitoring Activities determine whether internal control components and principles are present and functioning and whether deficiencies are addressed.
Key Takeaways
✓COSO Monitoring Activities contains Principles 16 and 17.
✓Monitoring uses ongoing and separate evaluations.
✓Deficiencies should be evaluated, communicated, remediated, and validated according to significance.
✓GRC traceability connects evaluations, evidence, findings, remediation, validation, and closure.
✓Monitoring metrics should support risk-based decisions.
COSO Monitoring Activities
Monitoring Activities is one of the five components of the COSO Internal Control — Integrated Framework. It helps the organization determine whether each component of internal control, including related principles, is present and functioning.
Effective monitoring provides ongoing and separate evaluations, identifies and communicates control deficiencies, and supports timely corrective action.
Why Monitoring Activities matter
Internal control cannot be considered effective simply because controls were designed and implemented. The organization also needs to determine whether controls continue to operate as intended and whether deficiencies are identified and addressed.
A mature monitoring program helps the organization determine whether controls are present and functioning, detect changes affecting effectiveness, identify deficiencies, prioritize corrective action, track remediation, and provide management with reliable information about control effectiveness.
The two COSO Monitoring Activities principles
Principle 16 — Conducts ongoing and/or separate evaluations
The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.
Ongoing evaluations are built into normal operations and can provide timely information about control performance. Separate evaluations provide additional perspective and may be performed periodically or when specific circumstances require them.
Examples include management reviews, control self-assessments, internal audit activities, compliance reviews, quality assurance reviews, automated monitoring, key control testing, risk and control assessments, and targeted reviews after significant changes or incidents.
Principle 17 — Evaluates and communicates deficiencies
Principle 16 addresses ongoing and/or separate evaluations, while Principle 17 addresses evaluating and communicating internal control deficiencies.
What is the difference between ongoing and separate evaluations?
Ongoing evaluations are integrated into routine operations; separate evaluations are distinct assessment activities that provide additional perspective.
What should a deficiency management process include?
It should define evaluation, severity, communication, corrective action, remediation tracking, validation, and closure criteria.
How does GRC support monitoring activities?
GRC can connect objectives, risks, controls, evaluations, evidence, findings, severity, remediation, validation, and closure.
From strategy to evidence
Set up your connected operating model. No sales delays or complex rollouts.
The organization evaluates and communicates internal control deficiencies in a timely manner to parties responsible for corrective action, including senior management and the board of directors, as appropriate.
A monitoring program should distinguish individual exceptions from deficiencies that may represent a broader problem.
The process should define who evaluates deficiencies, how severity is determined, who receives findings, when escalation is required, what corrective action is expected, how remediation is tracked, and when closure can be approved.
Each stage should have clear ownership and evidence.
Define scope
Determine the objectives, risks, controls, processes, systems, entities, and periods included in the evaluation.
Evaluate
Perform ongoing monitoring or separate evaluations using appropriate procedures and evidence.
Identify deficiency
Document exceptions, weaknesses, failures, or conditions that require attention.
Assess severity
Determine significance based on impact, likelihood, compensating controls, duration, and other relevant factors.
Communicate
Report findings to responsible parties and escalate significant matters according to defined requirements.
Remediate
Create and execute corrective actions that address the underlying cause and reduce recurrence risk.
Validate
Confirm that corrective action was implemented and that the deficiency has been effectively addressed.
Close
Close the issue only when defined closure criteria have been satisfied and authorized approval obtained where required.
Report
Provide management and oversight bodies with useful information about control effectiveness, deficiencies, remediation, trends, and unresolved issues.
Ongoing and separate evaluations
Ongoing evaluations are integrated into routine operations. Examples include management review, automated exception reports, reconciliations, supervisory reviews, operational metrics, and recurring control attestations.
Separate evaluations are distinct assessment activities such as internal audit reviews, targeted control testing, compliance assessments, or periodic framework evaluations.
Both approaches can be complementary. The appropriate mix should reflect the organization's risk profile, changes, and control significance.
Deficiency management
A useful deficiency record includes:
Deficiency ID.
Related objective, risk, and control.
Evaluation or test.
Finding description.
Root cause.
Impact and likelihood.
Severity.
Compensating controls.
Owner.
Corrective action.
Target date and status.
Validation result.
Closure approval.
Evidence.
Corrective action should address root cause, not only the immediate symptom.
This traceability helps answer which controls were evaluated, when they were tested, what evidence supported the evaluation, which deficiencies were identified, who owns remediation, which actions are overdue, and which issues have been validated and closed.
Useful metadata includes evaluation ID, evaluation type, scope, frequency, evaluator, control owner, test procedure, evidence, test result, finding, severity, remediation owner, due date, validation status, closure date, and escalation status.
Designing monitoring procedures
Monitoring procedures should be risk-based and precise enough to produce repeatable results.
A procedure should identify:
1. What is evaluated.
2. Why it is evaluated.
3. Who performs the evaluation.
4. When or how often it occurs.
5. What evidence is required.
6. What criteria determine pass or fail.
7. How exceptions are documented.
8. How deficiencies are assessed.
9. Who receives results.
10. How remediation is validated.
Automation can improve monitoring efficiency, especially for high-volume or continuous controls, but automated monitoring still depends on reliable data, appropriate rules, access controls, and governance.
Evidence should demonstrate not only that an evaluation occurred, but also that findings were assessed, communicated, remediated, and validated when required.
Common implementation mistakes
Monitoring without defined criteria
Evaluations should have clear criteria so results are consistent and defensible.
Testing controls without considering risk
Monitoring effort should reflect the significance and risk associated with the control.
Treating every exception as the same
Deficiencies should be evaluated according to their significance.
Closing findings without validation
Marking remediation complete does not necessarily demonstrate that the deficiency was effectively addressed.
Focusing only on symptoms
Corrective action should consider root cause to reduce recurrence.
Failing to escalate significant deficiencies
Significant matters should reach appropriate management and oversight levels promptly.
Losing evidence
Monitoring results, supporting evidence, remediation records, and closure approvals should be retained according to applicable requirements.
Monitoring metrics for GRC
Useful indicators can include:
Percentage of key controls evaluated on schedule.
Number of open deficiencies.
Number of overdue remediation actions.
Average remediation age.
Deficiencies by severity.
Repeat findings.
Percentage of findings validated before closure.
Monitoring coverage by risk category.
Control failures by process or business unit.
Trends in control effectiveness.
Metrics should support decisions rather than become reporting exercises disconnected from risk.
Conclusion
COSO Monitoring Activities provide the mechanism for determining whether internal control components and principles are present and functioning and whether identified deficiencies are addressed.
Principle 16 focuses on ongoing and/or separate evaluations, while Principle 17 focuses on evaluating and communicating deficiencies. In a GRC environment, monitoring is stronger when evaluations, evidence, findings, severity, remediation, validation, and closure are connected through end-to-end traceability.
