One of my passions over the last couple of years has been around the concepts and practices of continuous auditing, including management's continuous monitoring of controls.
My paper on this subject, see referenced link, has now been released. The proposition is that it is not sufficient to simply test controls; the work has to be done within the context of risk management, testing all and only the controls required to manage business risks.
