For many manufacturers, retailers and distributors, inventory is the largest operating asset on the balance sheet and one of the least continuously controlled. The standard assurance routine is familiar: a physical count at year-end or quarter-end, a reconciliation to the ledger, a provision for slow-moving stock, and an auditor who attends a sample of locations. Between those dates, stock can age, leak, be mis-booked or quietly lose its value, and the first time anyone sees it is the next count.
This article reframes inventory as a continuously monitorable control surface. We look at why periodic counts leave a gap, which five exceptions are worth testing every day, how monitoring supports valuation judgements without replacing them, and where AI agents help while people stay accountable. If you have followed our work on continuous procure-to-pay controls and order-to-cash exception monitoring, inventory is the control point that sits between them.
Crest.Digital’s Agentic GRC builds customised agents and continuous controls on top of your existing ERP, warehouse and procurement data, so stock exceptions, evidence and follow-up sit in one audit-ready trail.
Explore Agentic GRCWhy a Physical Count Is Necessary but Not Sufficient
A count answers one question well: does what is on the shelf match what the system says on this date? It answers other questions poorly. It does not tell you how long items have been sitting, whether a receipt was booked against the right purchase order, whether adjustments were approved by someone independent, or whether a pattern of small write-offs is concentrated in one warehouse or one user. By the time the count finds a variance, the cause is months old and the evidence is thin.
Auditors treat the area seriously for good reason. Inventory involves existence, completeness and valuation assertions at once, and the PCAOB expects auditors to obtain evidence that goes beyond management’s representations. In India, the auditor’s report under CARO 2020 also comments on management’s physical verification of inventory and the treatment of material discrepancies. Under IFRS (IAS 2) and US GAAP alike, stock is carried at the lower of cost and net realisable value or market, which makes ageing and obsolescence a reporting matter, not merely an operational one.
The COSO Internal Control framework names ongoing monitoring as a component of effective control. Daily, full-population testing of inventory transactions is a direct way to deliver it, and it fits the broader shift we describe in AI is moving audit from sampling to continuous assurance.
Five Inventory Exceptions Worth Testing Every Day
The following five areas combine clear rules, accessible data and meaningful exposure. Each can be written down as a control, a threshold and an owner.
1. Slow-moving and ageing stock. Calculate ageing by item, batch and location from the last movement date, and flag items crossing defined thresholds with no demand signal or open order. This is the earliest warning for a future provision, and the ageing bands should come from policy rather than from a spreadsheet that only one analyst understands.
2. Shrinkage and count-versus-system variances. Compare cycle-count results, scrap postings and adjustments with system balances by location. Look for repeat variances in the same bin or shift, adjustments posted just under approval limits, and write-offs raised and approved by the same user.
3. Goods received versus goods booked. Match goods-receipt notes, supplier delivery documents and ERP receipts. Receipts booked without a delivery record, quantities that differ from the purchase order, and receipts posted into a period after the physical movement are all cut-off and existence risks. This is also where inventory meets vendor risk, a link we explore in our guide to continuous vendor and third-party assurance.
4. Reorder threshold breaches. Test whether stock has fallen below minimum levels without a replenishment order, or whether orders were raised far above the defined maximum. Stock-outs hurt revenue and service; over-ordering creates tomorrow’s obsolete stock. Both signal that planning parameters are stale.
5. Obsolete and excess stock classification. Check that items meeting obsolescence criteria, such as discontinued products, expired shelf-life or superseded specifications, are actually classified and provided for. Monitoring ensures the classification list is complete rather than relying on whoever remembers to maintain it.
Supporting Valuation Judgements Without Replacing Them
Deciding the net realisable value of a product line is a management judgement, and it should stay one. What monitoring changes is the quality of the inputs. Instead of assembling an ageing report days before close, the finance team opens the quarter with a live view of ageing, movement, post-period selling prices where available and open demand. The provision conversation starts from evidence that was collected as it happened.
That is the same idea behind our work on evidence intelligence and control validation: the agent gathers, matches and records, and the control owner concludes. The controller still decides the provision; the support is complete, timestamped and ready for the auditor. When monitoring surfaces a systematic pattern, such as stock that is repeatedly mis-booked from one supplier, the vendor dimension can be raised through the TPRM platform rather than treated as a warehouse problem alone.
Repeated delivery mismatches and quality failures are third-party signals. Crest.Digital’s TPRM platform adds supplier screening, financial-health and performance intelligence across the industries we cover, including manufacturing, pharma and retail supply chains.
A Six-Step Plan to Stand Up Inventory Monitoring
We deliver continuous assurance as a configurable pod rather than a bespoke software build: reusable connectors, orchestration, workflow, an evidence repository and an audit trail, with client-specific effort concentrated on data mapping, control logic, approvals and dashboards. The sequence is discover, design, connect, deploy, validate, and transfer or manage.
Discover Where Stock Risk Actually Sits
Map locations, stock types, systems and handoffs: plants, warehouses, third-party logistics providers and consignment stock. Identify which controls rely on a periodic count, which on manual reconciliations, and where value and shrinkage exposure is highest.
Design Thresholds, Agents and Approvals
Turn each priority control into an explicit rule with an ageing band, tolerance or limit, an owner and an escalation path. Decide what an agent may investigate on its own and which decisions, such as approving a write-off or changing a reorder parameter, stay with named people.
Connect ERP, Warehouse and Procurement Data
Integrate item master, movements, goods receipts, purchase orders, adjustments and count results. A reconciled view of each item from purchase order to receipt to shelf to sale is what makes the rules testable.
Deploy the First Controls
Release a short list of high-value rules, for example ageing breaches, repeated adjustments, receipts without delivery evidence and unclassified obsolete items, with exceptions routed to owners and tracked to closure.
Validate Against the Next Count
Run the monitoring in parallel with the existing count cycle and compare. Measure whether it flagged the variances the count found, how many false positives it created, and agree accuracy thresholds before anyone relies on the output.
Transfer or Manage, Then Expand
Hand the solution to your team or run it as a managed service covering alert review, investigation and reporting. Add sites, entities and controls in waves, and keep the committee view current.
Step five is where trust is earned. A natural test is whether continuous monitoring would have predicted the last count’s variances weeks earlier. If it would have, the case for relying on it is strong; if not, tune the logic before expanding. The IIA’s standards expect audit conclusions to rest on sufficient, reliable evidence, and that applies equally to evidence produced by automation. For what happens once an exception is found, see our guide to audit issue remediation and follow-up agents.
Where Agentic AI Helps, and Where People Decide
Rules find exceptions; agentic AI investigates them. When a bin shows repeated negative adjustments, an agent can pull the movement history, identify the users and shifts involved, compare the pattern with similar locations, check for related goods-receipt problems and draft a summary for the warehouse controller. When a batch crosses an ageing threshold, it can look for open demand, recent sales and the supplier’s return terms before proposing an action. Context turns a bare alert into a decision made in minutes.
The boundary stays firm. Agents read, test, correlate and recommend; people approve write-offs, stock adjustments and master-data changes. Every step needs a log of the data used, the rule applied and the reviewer, otherwise the work cannot be re-performed or defended, a theme we cover in why AI agents need audit trails. And where unusual adjustments suggest misappropriation rather than error, the techniques in fraud and transaction-risk intelligence apply directly.
Your Turn: How Continuous Is Your Inventory Assurance?
- Count-driven: Inventory is verified at year-end or quarter-end, provisions are built from a late-stage ageing report, and adjustments are reviewed only when variances appear.
- Periodic and partly automated: Cycle counts and monthly analytics exist, but exceptions live in spreadsheets and evidence is chased by email.
- Continuous and evidenced: Ageing, adjustments and receipt mismatches are tested daily on full populations, owners resolve exceptions against deadlines, and the committee sees coverage and overdue actions.
Where would your Chief Audit Executive place you? Tell us in the comments when you share this on LinkedIn.
Crest Perspective
Internal audit’s relationship with third-party risk has historically been reactive — reviewing incidents after they occur rather than providing assurance that controls are operating effectively in real time. Continuous monitoring creates a new opportunity: internal audit can verify that risk ratings are recalculated when trigger events occur, that escalations are documented, and that the board is receiving accurate information about vendor exposure — all of which are more meaningful assurance activities than an annual programme review.
Frequently Asked Questions
Continuous inventory controls monitoring is the automated, ongoing testing of controls over stock: ageing and slow-moving items, count and system variances, goods received versus goods booked, reorder thresholds, adjustments and write-offs, and obsolete-stock classification. Rules and AI agents test every transaction against the control, flag exceptions, route them to owners and keep the evidence. It complements rather than replaces physical counts, giving management and internal audit a view between count dates.
No. Physical verification remains the primary evidence of existence and condition, and auditors and regulators continue to expect it. What monitoring changes is the focus and frequency: it targets cycle counts at locations and items that show risk signals, explains variances faster, and provides continuous evidence between counts. Many organisations find they can make counts more targeted and less disruptive once monitoring shows where the exposure actually lies.
Start with controls that combine strong data, clear rules and material exposure: ageing and slow-moving stock, repeated or unapproved adjustments and write-offs, receipts without matching delivery documents or purchase orders, and unclassified obsolete items. These map to the existence, completeness and valuation assertions auditors test, and the data is usually available in the ERP and warehouse systems without major integration work.
They should not. In a well-governed design, agents read, test, investigate and recommend, while named people approve write-offs, stock adjustments, reclassifications and master-data changes. Each agent action is logged with the data used, the rule applied and the reviewer, so the work can be re-performed. This human-in-the-loop principle is consistent with segregation of duties and ongoing monitoring in frameworks such as COSO, and it keeps accountability with management.
A focused first release covering a handful of controls on one ERP or warehouse system can usually be scoped, built and validated in parallel with the existing process within weeks rather than quarters, because connectors, workflow, evidence repository and audit trail are reusable. The client-specific work is mapping data fields, agreeing ageing bands and tolerances, and defining approval workflows. Comparing results against the next count gives a practical measure of accuracy before the output is relied on.