1. Definition
Monitoring is the continuous, short-term process by which the Jigsaw Team (or delegated control owners) tracks whether controls are operating as intended — detecting deviations, drift, exceptions, or anomalies. Monitoring ensures that the system is working as designed, and triggers corrective action when controls fail or underperform.
2. Purpose of Monitoring
- Assurance — Confirm that control execution aligns with design and expectations
- Early detection — Identify deviations, drift, or emerging weak signals before they become problems
- Corrective responsiveness — Enable timely adjustment or reinforcement of controls
- Feedback for control tuning — Provide data to refine thresholds, usage, or support
- Support defensibility — Show you are not only designing controls, but actively tracking their performance and responding to failures
3. Key Elements / What Should Be Included & How to Do It (SAM Focus)
- Key Risk/Control Indicators (KRIs / KCIs) — metrics or thresholds tied to control performance (e.g., % complete training, supervision checks, report escalation lag)
- Exception reporting & alerts — flags when indicators deviate beyond tolerance
- Regular dashboards/scorecards — control performance trends over time
- Trend analysis — identify drift, slippage, or systemic patterns
- Escalation triggers — defined thresholds that prompt deeper investigation or review
- Ownership & accountability — control owners responsible for monitoring and first-response
- Documentation & logs — record what was monitored, when, what anomalies found, and what actions taken
- Integration with review — feed monitoring data into later reviews
4. Fit-for-Purpose Criteria
- Strategic Fit Indicators and metrics tie directly to the highest risks and key system goals, not arbitrary metrics.
- Operational Fit Monitoring is feasible, reliable, timely, not overly burdensome; thresholds set realistically; dashboards usable by control owners.
- Lived Experience Fit Monitoring is transparent, not punitive; staff understand and accept indicators; negative results lead to support, not blame.
- Defensibility (Traceability) Monitoring logs, alert histories, response records are versioned, traceable, reviewed, and linked to actions.
5. Indicators of Effective Monitoring & Warning Signs
Success Indicators
- Deviations or anomalies detected early and acted upon
- Trends in control performance remain within acceptable bounds
- Monitoring data regularly referenced in Jigsaw Team meetings
- Corrective adjustments made promptly when issues arise
- Monitoring logs used in reviews and learning
Warning Signs
- Persistent drift or control performance decline without detection
- Indicators set too loosely or too stringently (leading to noise or silence)
- Alerts ignored or “alert fatigue”
- Monitoring becomes purely administrative with no real response
- Control failures discovered only in incidents or audits
6. Common Strengths & Gaps
Strengths
- Enables proactive correction before incidents
- Builds continuous feedback into operations
- Helps maintain “health” of the system
Gaps / Weaknesses
- Indicators poorly chosen, disconnected from real risk
- Insufficient frequency or lag in reporting
- Ownership unclear or ignored
- Overemphasis on quantitative metrics without qualitative insight
- Monitoring not connected up to review or governance, so value lost
7. Signals of Strong Monitoring
- Dashboards reflect real trends, not just compliance tick-boxes
- Control owners act on flagged deviations swiftly
- Monitoring data regularly informs decision-making in meetings
- Patterns of drift or anomalies are surfaced and addressed
- Monitoring logs are auditable and integrated into review cycles
8. Opportunities for Improvement
- Revisit and refine KRIs / KCIs periodically
- Introduce automated alerts or dashboards if feasible
- Train control owners in interpreting trends and taking action
- Link monitoring failures to escalation to review where needed
- Ensure monitoring reporting is understandable, visible, and meaningful
9. How Monitoring Is Tracked in Jigsaw
- Each control has assigned KRIs/performance metrics recorded in Jigsaw
- Jigsaw Team meeting agenda includes review of control performance metrics
- Anomalies or flagged issues are recorded and escalated
- Monitoring outputs feed directly into review sessions and change planning
Bottom Line
Monitoring is the operational heartbeat of the safeguarding system — the process that ensures controls are doing what they should. Without monitoring, drift or failure go unnoticed. But monitoring alone isn’t enough: you must also be willing to review the system itself. Monitoring tells you when things are off; reviewing tells you whether your design is still right.