What Is Continuous Monitoring?
Continuous monitoring is the ongoing, automated tracking of risks, controls, compliance, and performance indicators throughout the governance lifecycle. Rather than relying solely on periodic assessments, continuous monitoring provides real-time visibility into the organization's governance posture.
What Continuous Monitoring Tracks
Continuous monitoring tracks: key risk indicators (KRIs) that signal changing risk levels, key performance indicators (KPIs) that measure performance against targets, control effectiveness metrics, compliance status changes, vendor performance and risk signals, and emerging risk indicators from internal and external sources.
Periodic vs. Continuous Monitoring
Periodic monitoring (annual assessments, quarterly reviews) provides snapshots; continuous monitoring provides a real-time view. Both are needed — periodic assessments provide depth, continuous monitoring provides timeliness. The combination ensures risks are identified and addressed before they escalate.
Key Risk Indicators (KRIs)
KRIs are metrics that signal changes in risk levels — for example, an increasing number of failed login attempts (cyber risk), declining vendor performance scores (third-party risk), or rising compliance finding counts (compliance risk). KRIs should have defined thresholds that trigger alerts when exceeded.
How MPG Supports Continuous Monitoring
MPG provides continuous monitoring through KPI tracking, risk signal detection, automated assessment cycles, compliance deadline alerts, vendor performance monitoring, and emerging risk scanning. Threshold-based alerts notify owners when indicators exceed acceptable levels, enabling proactive risk management.
Key Takeaways
- Continuous monitoring provides real-time visibility into governance posture
- It tracks KRIs, KPIs, control metrics, compliance status, and vendor signals
- Both periodic and continuous monitoring are needed — depth and timeliness
- Threshold-based alerts enable proactive risk management
Frequently Asked Questions
What is the difference between a KRI and a KPI?
A KPI measures performance against a target (e.g., 95% on-time delivery); a KRI measures risk level (e.g., number of vendor incidents per month). KPIs ask 'how well are we doing?'; KRIs ask 'what is our risk level?' Both are tracked in MPG.
Can continuous monitoring replace periodic assessments?
No — they complement each other. Continuous monitoring provides real-time signals, but periodic assessments provide depth through detailed evaluation. MPG supports both, with continuous monitoring triggering targeted assessments when risk signals emerge.