Choice "C" is correct. The COSO identifies four stages of the change continuum beginning with control baseline, followed by change identification and change management and concluding with control validation/ update. Change identification considers the risk assessment component of internal control and identifies changes in process or risk and verifies that the design of underlying controls remains effective. Monitoring through the use of ongoing and separate evaluations should consider the ability to identify and address changes in the change identification stage of the monitoring for change continuum.
Choice "a" is incorrect. Monitoring starts with a control baseline that supports the understanding of an internal control system's design and whether controls have been implemented to accomplish internal control objectives. The base line is the starting point and does not address the methods of control monitoring.
Choice "b" is incorrect. Change management contemplates the establishment of a new control baseline in response to changes that either occur or are implemented in response to revised needs. Change management does not contemplate the selection of ongoing or separate evaluations.
Choice "d" is incorrect. Control revalidation and update contemplates confirmation of control effectiveness. Ongoing procedures routinely revalidate and create a continuous baseline while separate evaluations provide periodic revalidation. The revalidation verifies or challenges of the baseline. The use of ongoing or separate evaluations is determined, however, as part of change identification.