Control inventories that drift from the monitoring application

An approved control inventory lives in a document store. The monitoring application holds its own list of monitored items, often renamed by successive administrators. Application audit work that ignores the gap between those two lists will grade a system that no longer watches the controls the board thinks it watches.

First reconciliation

Export both lists with identifiers, owners, and process names. Match on stable IDs where they exist; where they do not, match on process and owner together, not on free-text titles alone. Record three buckets: matched, inventory-only, application-only.

What each bucket means

Inventory-only rows are controls without a monitoring path in the application. Application-only rows are monitored items without an approved control — noise that consumes operator time and confuses exception reporting. Matched rows still need a later check that the monitoring routine matches the control’s intent, but mapping comes first.

Practical tip for sponsors

Freeze renames during the review window. Mid-engagement title changes make reconciliation look worse than the underlying control design and waste interview time.