A Framework for Continuous Auditing: Why Companies Don't Need to Spend Big Money; Organizations Seeking to Implement or Improve Continuous Auditing Often Already Have the Data and Tools Necessary
Big Data is powerful. It can also be daunting. The current data analytic landscape focuses on the use of "scripts" that can identify duplicates and quantitative outliers. Yet, there is little guidance for script implementation or use of existing resources. Organizations are investing time and money in continuous auditing. However, success is limited to a few larger organizations with the resources needed to accomplish their implementation. For example, some companies have implemented continuous auditing processes for accounting functions, such as accounts payable (AP), which have added to their internal control structure and aided in Sarbanes-Oxley (SOX) readiness. These organizations have applied data analysis that alerts them to repeating check or invoice numbers, recurring and repetitive amounts, and the number of monthly transactions. All of this is considered basic fraud prevention. The problem is that this ignores other risks and rarely provides value. Sometimes, a company spends thousands of dollars to implement these processes but does not get value from them. This article discusses the appropriate methods organizations should use in implementing continuous auditing procedures. Companies don't need complex data analytics tools or a large budget to employ an effective continuous auditing program. Organizations in the market for audit software can take advantage of a variety of tools. Those with little or nothing to spend can still achieve effective continuous auditing with simple yet powerful tools, such as Excel, and by thinking differently about data they already have. THE CONTINUOUS AUDITING REASONING Internal auditing's testing of controls is based on risk and often performed months after business activities have occurred. The testing is based on a sampling approach and includes reviews of policies, procedures, approvals, and reconciliations. Today, it is recognized that this approach affords internal auditors with a narrow scope of evaluation and is sometimes too late to be of real value to business performance or regulatory compliance. Continuous auditing is a method used to perform control and risk assessments automatically on a more frequent basis. Continuous auditing focuses on testing for the prevalence of a risk and the effectiveness of a control. A framework and detailed procedures, along with technology, are key to enabling such an approach. Continuous auditing offers another way to understand risks and controls and enhances sampling from periodic reviews to ongoing testing. Continuous auditing is not intended to replace traditional auditing but is rather to be used as a tool in implementing certain standard audit procedures to enhance audit methodology and effectiveness. For example, continuous auditing may occur by performing trend analysis on expense accounts to identify variances or drivers and alerting the audit team to a potential issue. IMPLEMENTATION PLAN Implementing a continuous auditing model can be difficult at first. It is a process that grows as the maturity of the audit function grows. Initial project objectives are focused on developing a model and implementing processes to discover and analyze patterns, identify anomalies, and extract other useful information in data. Start small with the development of the continuous auditing model and plan to expand your systems' capability as your understanding of the organization's data and underlying concepts grows. After development, the next step is to align the continuous auditing model with internal audit's methodology and processes. Continuous auditing employs skill sets and resources that are different from traditional approaches; however, the methodology used to carry out the function is not significantly different. Continuous auditing is a function, like operational or IT audits, that helps internal audit management accomplish its objectives. …