feisty
AMS, shorthand for Audit and Monitoring Systems, has spent years sitting quietly in the risk function of Australian companies. Boards delegated it. Management ran it. Nobody put it in a press release. That's changing. Across ASX-listed companies in 2026, AMS capability is increasingly appearing in board skills matrices, remuneration rationale, and committee charters. It's no longer a compliance footnote. It's a governance instrument.
What AMS actually covers
The term is broader than it sounds. AMS refers to the integrated frameworks, software platforms, and oversight structures that a company uses to track its own compliance obligations, internal controls, and risk exposures in real time. It covers everything from financial reporting controls and regulatory audit trails to operational risk dashboards and third-party monitoring.
Three capabilities tend to define a mature AMS setup: continuous control monitoring (automated testing of financial controls rather than point-in-time audits), integrated risk registers that connect to the board's risk appetite statement, and exception reporting that goes directly to the audit committee without passing through management first. That last point is the one most companies still don't have.
The absence of direct-to-committee reporting is precisely what regulators have started calling out. ASIC's enforcement actions over the past two years have repeatedly cited the gap between what management reported to the board and what the AMS data actually showed. The gap isn't always deliberate. Sometimes it's structural: the system exists, but the data path from system to director never got built.
Why the board is paying attention now
The shift in board engagement with AMS has two drivers. The first is regulatory. ASIC's continuous disclosure expectations have effectively required companies to know, in something close to real time, whether a material risk has crystallised. You can't meet that standard without an AMS that surfaces exceptions quickly. The second driver is insurance: D&O underwriters have started asking about AMS maturity in the renewal process, and some are pricing the absence of direct audit committee access as an elevated risk factor.
Both forces land on the board rather than management, which is why director-level fluency in AMS has become a genuine skills-matrix question. When a board adds a skills matrix to its annual report, AMS capability is now one of the categories companies are voluntarily disclosing, a signal that the governance community has accepted it as a board-level competency rather than a management-level tool.
The audit committee chair carries most of the weight here. That person needs to understand what the AMS is configured to catch, what it isn't, and whether the exception thresholds were set by management or independently validated. Those are not technical questions. They're governance questions, and they go directly to whether the board has real oversight or just the appearance of it.
Where companies are getting it wrong
The most common failure isn't a missing system. Most mid-cap and large-cap ASX companies have purchased AMS software. The failure is in configuration. Systems get deployed with default settings, exception thresholds get left at vendor-recommended levels, and nobody on the board ever asks who set the parameters or why.
A second failure pattern is siloing. The AMS for financial controls sits in one function, the operational risk register sits in another, and the compliance monitoring tool for regulatory obligations is in a third. None of them talk to each other, and the board receives three separate reports that don't aggregate into a single risk picture. This is the structural problem that a special committee is sometimes created to address when a governance crisis has already occurred. Fixing it before the crisis is the point of a functioning AMS.
The third failure is velocity. AMS data that gets reported quarterly is almost useless for continuous disclosure purposes. The value of the system is in frequency: weekly exception reports at minimum, with real-time alerting for high-severity control failures. Companies that installed AMS for the audit trail and then defaulted to quarterly reporting have the cost of the system without most of the benefit.
What good looks like in practice
A well-configured AMS on an ASX board gives the audit committee chair three things without asking management for them: a live view of which key controls are passing and which are in exception, an automated audit trail that can be produced for a regulator within hours, and a direct feed of material exceptions that bypasses the management reporting layer.
The board doesn't run the system. But the board sets the terms. It approves the exception thresholds, the reporting frequency, and the escalation triggers. It reviews the system's outputs independently of management's commentary on those outputs. And it asks, at least annually, whether the system is configured to catch the risks the company actually faces, not the risks it faced three years ago when the platform was first deployed.
That last discipline is where most boards fall short. AMS configurations go stale. Business models change, acquisitions add new risk surfaces, and regulatory requirements shift, but the monitoring parameters don't update unless someone is accountable for updating them. The audit committee chair is the right person to own that accountability. Not the CFO. Not the CRO. The board.
In 2026, AMS fluency is becoming one of the cleaner proxies for genuine board oversight. The companies where directors can describe their AMS setup in specific terms are, on the evidence, the ones where governance is working in practice rather than just on paper.