How do auditors test ongoing monitoring for a credit model?

Auditors should first identify the required monitoring metrics, frequency, thresholds, owners, and escalation path. Then they should test whether monitoring occurred on time, used complete and accurate data, identified threshold breaches, and led to action when performance deteriorated.

For a credit model, monitoring might include population stability, discriminatory power, override rates, approval cutoffs, default performance, missing input fields, and drift in key variables. Internal audit does not need to invent new metrics if policy defines suitable ones, but it should challenge vague monitoring that never triggers action.

The strongest evidence is not a dashboard screenshot. It is a trail from metric calculation to review, breach assessment, assigned remediation, and committee or management follow-up.