What is the primary purpose of monitoring and exception reporting within a governance or risk framework?

• A. To manage IT infrastructure
• B. To conduct external audits
• C. To detect deviations from policies and timely escalate
• D. To replace control activities

Answer: (C)

Monitoring and exception reporting focus on spotting when actual activities diverge from established policies, standards, or risk thresholds, so these deviations can be addressed promptly. This enables governance to maintain control, trigger timely remediation, and provide evidence that risk is being actively managed. By flagging exceptions, organizations can investigate root causes, assign accountability, and implement corrective actions before issues escalate into bigger problems. It’s not primarily about managing IT infrastructure, nor is it about conducting external audits, and it doesn’t replace control activities; instead it supports and strengthens them by ensuring deviations are detected and acted upon in a timely way.