Internal audit and Continuous Control Assurance (CCA) work together when management runs the assurance program and internal audit evaluates it independently, then decides how far to rely on its results in its own work. Management tests the controls every day. Internal audit tests whether that testing can be trusted, and it keeps its own judgment on everything the tests cannot see.
Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected. Continuous Control Monitoring (CCM) monitors conditions, evidence and signals associated with controls. CCM is a capability within CCA. This article sets out who does what, what the Institute of Internal Auditors asks before internal audit relies on another provider’s work, how internal audit keeps its independence, and what it should expect from the data.
Who runs Continuous Control Assurance (CCA), and where does internal audit sit?
Management runs Continuous Control Assurance, and internal audit sits outside it. The IIA’s Three Lines Model, published in July 2020, gives management the first and second line roles of managing risk, and gives internal audit independent and objective assurance on whether governance and risk management are adequate and effective. It adds that internal audit may consider assurance from other internal and external providers, which is where a continuous assurance program comes in.
| Role | What it does in Continuous Control Assurance | What it should not do |
|---|---|---|
| Control owners in security and IT (first line) | They keep each control in its expected state and fix it when a test fails. | They should not approve their own exceptions. |
| The risk or compliance function (second line) | It runs the program, writes the expected states with the control owners, reviews failures and reports the results. | It should not present the program as a substitute for independent assurance. |
| Internal audit (third line) | It evaluates the program, decides how far to rely on its results and uses the data in its own risk assessment and audits. | It should not design or run the tests, set expected states or accept exceptions. |
| The external auditor | It decides separately, under its own standards, whether to use the results as evidence. | It is not bound by internal audit’s reliance decision. |
The model also says that independence “does not imply isolation.” Internal audit should hear about the program early, comment on its design and have read access to its results, while the decisions inside the program stay with management. How to Start a Continuous Control Assurance (CCA) Program covers the ownership question from management’s side.
Is Continuous Control Assurance (CCA) the same as continuous auditing?
It is not, and the difference is ownership. Continuous Control Assurance is management’s program for knowing whether its controls still work. Continuous auditing is internal audit’s own ongoing work. The IIA’s guide Continuous Auditing and Monitoring, 3rd edition, issued and effective on 25 September 2025, is described on the IIA’s page as showing how continuous auditing uses technology to assess risks and controls on an ongoing basis, so that internal audit can offer continuous assurance to the board and senior management. The same page says integrating continuous auditing with continuous monitoring can improve efficiency, risk management and control effectiveness.
In practice the 2 share data and keep separate judgments. Internal audit can run its own analytics on the same evidence, or it can evaluate management’s program and rely on its results. The Continuous Control Monitoring page sets the 2 side by side in a table.
How can internal audit use continuous control data?
Internal audit can use continuous control data in 4 places, and each one keeps the audit judgment with internal audit.
- It can use the data in its risk assessment and audit plan. A control family with repeated failures, long open findings or many accepted exceptions is a stronger candidate for an audit than one that has passed quietly for a year.
- It can use the data to scope an engagement. The history of results shows which systems, business units or periods deserve attention before fieldwork starts.
- It can use the results as evidence in an engagement, after it has evaluated the program and documented the basis for relying on it.
- It can use the finding and retest records to follow up action plans. A finding that closed on a passing retest is evidence of remediation, while a finding closed on a promise is not.
The Global Internal Audit Standards, issued on 9 January 2024 and effective from 9 January 2025, ask for this kind of coordination. Standard 9.5, Coordination and Reliance, requires the chief audit executive to coordinate with internal and external providers of assurance services and to consider relying on their work. Its guidance lists examples such as using management’s risk management information for joint risk assessments and creating a shared risk register.
What should internal audit check before relying on Continuous Control Assurance (CCA) results?
Internal audit should evaluate the program the way the standards ask it to evaluate any other assurance provider. Standard 9.5 requires the chief audit executive to document the basis for reliance and states that the chief audit executive remains responsible for the conclusions internal audit reaches. Its considerations for implementation name what the evaluation should cover, and each one has a practical counterpart in a Continuous Control Assurance program.
| What Standard 9.5 asks the chief audit executive to consider | What to check in a Continuous Control Assurance program |
|---|---|
| The provider’s roles, reporting lines and any conflicts of interest | Check who owns the program, who can change a test and whether any control owner approves their own exceptions. |
| The provider’s competency and professional experience | Check who writes the expected states and whether they understand both the control and the system that enforces it. |
| The methodology and the care applied in planning, supervising, documenting and reviewing the work | Check that test definitions are documented, versioned and approved, and that changes to expected states have an approver. |
| Whether findings and conclusions rest on sufficient, reliable and relevant evidence | Check that each result names its source and read time, that populations reconcile to the source system, and that missing or stale evidence is recorded as undecided. |
Two practical tests settle most of the question. Re-perform a sample of results by hand and compare the answers, and trace one result end to end, from the requirement through the control, the test and the evidence to the retest. How Automated Control Testing Decides Whether a Control Still Works lists the checks that validate an automated test, and Is Automated Evidence Trustworthy? covers provenance, freshness and failed integrations in detail.
If the evaluation shows the work cannot be relied on, the standards leave internal audit 2 options. It can retest the work and gather more information, or it can perform the assurance itself. Where internal audit intends to rely on the program for a long period, the guidance to Standard 9.5 suggests documenting the agreed relationship and the testing and evidence required to support it.
How does internal audit keep its independence when it uses continuous data?
It keeps its independence by using the data without owning any part of the program that produces it. Standard 2.2, Safeguarding Objectivity, requires internal auditors to refrain from assessing activities for which they were previously responsible, and it presumes objectivity is impaired if an internal auditor provides assurance on an activity they were responsible for within the previous 12 months. The Three Lines Model says internal audit’s independence is safeguarded by not making decisions or taking actions that are part of management’s responsibilities.
For a Continuous Control Assurance program, that translates into 4 working rules.
- Internal audit does not write the tests or set the expected states, although it can comment on their design as advice.
- Internal audit does not accept exceptions, close findings or change mappings.
- Internal audit has read access to the results, the evidence and the full history, and that access is logged like any other.
- An internal auditor who helped build the program does not audit it within the period the standards set.
The first rule is the one programs break most often. If internal audit designs and runs the tests, it ends up auditing its own work, and the reliance decision loses its meaning.
What should internal audit expect from continuous assurance data?
Internal audit should expect data it can re-perform, not a dashboard it has to believe. A program that is ready for internal audit provides the following for every control in scope.
- It provides every result with the source of its evidence, the time the evidence was read and the population the test covered.
- It keeps undecided results separate from failures, so a broken feed never looks like a working control.
- It records every exception with the person who accepted it, the reason and the expiry date.
- It keeps the history of findings and retests, including how long each failure stayed open.
- It keeps a log of changes to test definitions, expected states and mappings, with the approver of each change.
- It shows where AI reached a conclusion, and it names the person who reviewed that conclusion.
A series of results with this record shows how a control behaved across a whole period, which a single point-in-time test cannot show. Why Point-in-Time Audits Miss Control Failures explains that difference, and How to Continuously Maintain Audit Readiness covers keeping the record ready between audits.
What does Continuous Control Assurance (CCA) change in the audit plan?
It moves internal audit’s attention from re-testing samples of automated controls to testing the program and the areas automation cannot reach. Operating effectiveness of system-enforced controls is where continuous testing does most of the work. Design effectiveness stays a human judgment, as the Continuous Control Assurance page explains, and so do governance, culture, risk appetite and controls that leave no machine-readable trace.
A plan that takes this into account usually has 3 parts. The first is an evaluation of the Continuous Control Assurance program itself, repeated on a cycle. The second is continued audit work on design, judgment and manual controls. The third is internal audit’s own analytics, run on the same data where independent coverage is needed. Standard 10.3, Technological Resources, asks the chief audit executive to make sure internal audit has technology that supports its process and to evaluate that technology regularly, which includes the access internal audit needs to this data.
The external auditor makes its own decision. PCAOB AS 1105 asks an auditor who uses information produced by the company to test its accuracy and completeness or the controls over it, and that decision is separate from internal audit’s. Will auditors accept automated control test results as audit evidence? covers the external auditor’s side.
An illustration: an access controls audit
This example is an illustration. The organization is invented, and the example uses no measured figures.
An insurer’s risk function runs Continuous Control Assurance for identity controls, including multifactor authentication for administrators, joiner and leaver processing and privileged access reviews. Internal audit has read access to the results and the evidence. When it plans the year, it sees that leaver processing failed several times in one business unit and that 2 exceptions were accepted by the same manager who owns the control.
Internal audit schedules an access controls audit for that unit. Before fieldwork, it evaluates the program against its reliance methodology: it reviews the test definitions and their change log, reconciles the account population with the identity provider, re-performs a sample of results by hand and traces 1 failure through to its retest. It documents the basis for relying on the multifactor authentication and leaver results, and it tests the privileged access reviews itself, because those depend on a reviewer’s judgment. Its report raises the self-approved exceptions as a governance finding, which no automated test would have raised.
How DigitalXForce supports internal audit
DigitalXForce is built for management’s side of this relationship. The AI-Powered Risk Management and Automated GRC module maps each control once to 50+ compliance frameworks, and its A-Assess modality prepares evidence and findings in the form auditors review. The platform gives internal audit and third-party auditors structured workflows to evaluate evidence, record control effectiveness and track findings to remediation, and auditors still attest, as the FAQ answer on audit workflows says.
Evidence is read through 250+ technology integrations from the systems that enforce each control, and every result carries the time its evidence was read. The Automated Audit Management and Assessment page describes the audit views.
DigitalXForce does not perform internal audits. Auditors use the DigitalXForce platform, and DigitalXForce makes its clients ready for their audits.
Where DigitalXForce is not the answer
A startup or small company preparing its first SOC 2 report can start with DigitalXForce Lite, which runs the platform in the cloud with the same functionality as the full platform and a faster deployment.
Questions about internal audit and Continuous Control Assurance (CCA)
How do internal audit and Continuous Control Assurance (CCA) work together?
Management runs Continuous Control Assurance (CCA), and internal audit evaluates the program independently and decides how far to rely on its results. Internal audit uses the data in its risk assessment, its audit plan and its follow-up of action plans, and it keeps its own judgment on design, governance and controls a machine cannot test.
What does Continuous Control Assurance (CCA) mean for internal audit?
It gives internal audit a complete, timestamped history of how each control behaved, instead of a sample from one day. It also gives internal audit a new subject to audit, which is the program itself, including its test definitions, its exceptions and the reliability of its evidence.
How can internal audit use continuous control data?
Internal audit can use it to target its risk assessment and audit plan, to scope engagements, as evidence once it has documented the basis for reliance, and to check that findings closed on a passing retest. The IIA’s Global Internal Audit Standards ask the chief audit executive to coordinate with other assurance providers and to consider relying on their work.
Can internal audit rely on Continuous Control Assurance (CCA) results?
It can, after evaluating the program. Standard 9.5 of the Global Internal Audit Standards asks the chief audit executive to document the basis for reliance, which covers the provider’s independence, competency and methodology and whether its conclusions rest on sufficient, reliable and relevant evidence. The chief audit executive stays responsible for internal audit’s conclusions.
Does internal audit lose its independence if it uses Continuous Control Assurance (CCA) data?
It does not, provided it uses the data without owning the program. Internal audit should not write the tests, set expected states or accept exceptions, and an auditor who helped build the program should not audit it within the period the standards set.
What should internal audit expect from continuous assurance data?
It should expect every result with its source, read time and population, undecided results kept apart from failures, exceptions with an approver and an expiry date, a history of findings and retests, and a log of changes to tests and mappings. Where AI reached a conclusion, the record should name the person who reviewed it.
Is Continuous Control Assurance (CCA) the same as continuous auditing?
It is not. Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected, and management runs it. Continuous auditing is internal audit’s own ongoing assessment of risks and controls, which the IIA describes in its guide Continuous Auditing and Monitoring, 3rd edition.
Sources
- The Institute of Internal Auditors issued the Global Internal Audit Standards on 9 January 2024, effective from 9 January 2025, at https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/. The complete Standards are public at https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/free-documents/complete-global-internal-audit-standards/, and Standards 2.2, 9.5 and 10.3 are cited here.
- The IIA issued Continuous Auditing and Monitoring, 3rd edition, a Global Technology Audit Guide, on 25 September 2025, at https://www.theiia.org/en/content/guidance/recommended/supplemental/gtags/continuous-auditing-and-monitoring/. The guide is for IIA members, and this article relies only on the IIA’s public description of it.
- The IIA published The IIA’s Three Lines Model: An update of the Three Lines of Defense in July 2020, at https://www.theiia.org/globalassets/documents/resources/the-iias-three-lines-model-an-update-of-the-three-lines-of-defense-july-2020/three-lines-model-updated-english.pdf, and principles 3 to 5 and the section on independence are cited here.
- The PCAOB’s AS 1105, Audit Evidence, covers information produced by the company in paragraph .10, at https://pcaobus.org/oversight/standards/auditing-standards/details/AS1105.
- Every source above was read on 26 September 2026.
What this looks like in practice.
Reading about continuous evidence is one thing. Watching a control get tested against live data from your own stack is another. A 30 minute walkthrough on your frameworks shows the difference.
