Documenting Monitoring Efforts: A Discussion with James Rose from SunHawk Consulting

Episode Date: July 2, 2024

In this episode of Stark Integrity, James Rose, Managing Director at SunHawk Consulting, joins Bob Wade (Captain Integrity) to explore a critical—but often overlooked—component of an effective compliance program:

Documenting monitoring efforts.

While many organizations perform monitoring activities, far fewer consistently document those efforts in a way that demonstrates compliance, oversight, and effectiveness. This episode focuses on how to close that gap.

Monitoring Is a Core Compliance Function

A foundational takeaway from this discussion is:

Monitoring is not optional—it is a core component of a functioning compliance program.

Monitoring allows organizations to:

• Identify emerging risks
• Detect breakdowns in controls
• Confirm that policies are being followed

Unlike audits, which are periodic:

Monitoring is continuous and embedded in day-to-day operations.

This ongoing nature is what makes documentation so important.

The Difference Between Monitoring and Auditing

A key concept highlighted in the episode is the distinction between:

• Monitoring → ongoing, operational oversight
• Auditing → periodic, independent evaluation

Monitoring:

• Is performed by those closest to the process
• Focuses on identifying issues in real time
• Serves as an early warning system

Auditing:

• Is independent and structured
• Evaluates whether monitoring is effective
• Provides objective validation

This distinction matters because:

You cannot demonstrate an effective compliance program without both.

Why Documentation Matters

One of the most important themes in this episode is:

If it is not documented, it did not happen—from a compliance perspective.

Organizations may be performing robust monitoring activities, but without documentation, they cannot:

• Prove oversight to regulators
• Demonstrate program effectiveness
• Show consistent application of controls

Documentation is what transforms:

• Activity → into evidence
• Process → into defensibility

Annual Attestations and Accountability

The episode also emphasizes the importance of:

Annual attestations of compliance.

These attestations:

• Require leaders to confirm that monitoring is occurring
• Reinforce accountability at all levels
• Create a formal record of oversight

When properly structured, they:

• Strengthen governance
• Promote ownership of compliance responsibilities
• Support defensibility in enforcement scenarios

Building Controls and Oversight into the Business

Another key takeaway is that monitoring should not be:

A separate compliance function—it should be integrated into operations.

This includes:

• Embedding monitoring into workflows
• Aligning oversight with operational responsibilities
• Creating clear ownership for monitoring activities

Because ultimately:

The most effective monitoring programs are built into how the organization operates—not added after the fact.

Where to Start with Monitoring

For organizations looking to improve, the episode suggests focusing on:

• High-risk areas first
• Clearly defined processes
• Practical, repeatable monitoring activities

This allows organizations to:

• Build momentum
• Demonstrate early value
• Expand over time

The key is not perfection—it is consistency.

Common Monitoring Mistakes

The discussion also highlights several common pitfalls:

• Failing to document activities consistently
• Treating monitoring as a one-time task instead of an ongoing process
• Confusing monitoring with auditing
• Lack of clear ownership and accountability
• Not following through on identified issues

These issues can undermine even well-intentioned programs.

Because in practice:

Weak documentation can make a strong program appear ineffective.

From Monitoring to Demonstration

A mature compliance program does more than perform monitoring—it:

Demonstrates that monitoring is effective.

This requires:

• Clear documentation
• Defined processes
• Consistent execution
• Measurable outcomes

Because regulators are not just asking:

• Do you monitor?

They are asking:

• Can you prove it?

Practical Compliance Considerations

From an operational standpoint, organizations should:

• Establish clear monitoring protocols
• Assign ownership at the operational level
• Document monitoring activities consistently
• Implement annual attestations to reinforce accountability
• Track and respond to findings over time

Because ultimately:

Monitoring without documentation does not create defensibility.

Key Takeaways

• Monitoring is a continuous, core compliance function
• Documentation is essential — without it, monitoring cannot be demonstrated
• Monitoring and auditing are distinct but complementary
• Annual attestations strengthen accountability and governance
• Monitoring should be embedded into operations—not isolated
• Consistency matters more than complexity
• Weak documentation undermines strong programs

Final Thoughts

This episode reinforces a critical reality in compliance:

Performing the work is only half the battle—proving the work matters just as much.

Monitoring is what helps organizations:

• Identify risk
• Maintain control
• Stay ahead of issues

But documentation is what allows organizations to:

Demonstrate that those efforts are real, consistent, and effective.

Ultimately:

A strong compliance program is not just built on activity—it is built on evidence.

Because in today’s regulatory environment:

The strength of your monitoring program is measured not just by what you do—but by what you can prove.

Click here to listen to this Stark Integrity Podcast Episode:
https://podcasts.apple.com/us/podcast/documenting-monitoring-efforts-a-discussion-with/id1588939373?i=1000660981321&l=fr-FR