AUDIT ANALYTICS AUDIT

ESSAY 6: MANAGING RISK AND THE AUDIT PROCESS
profile. The authors also contend that CRMA should ideally be fully
integrated within a structure that includes both Continuous Controls
Monitoring (CCM) and Continuous Data Assurance (CDA) such that a
robust system of continuous auditing is ultimately achieved (figure 6-1).
Figure 6-1: Integrated Components in Continuous Auditing
(Vasarhelyi, Teeter, Krahel 2010)
In practice, there might be an initial tendency to implement one or more
of the modules in a mutually exclusive manner. For instance, an
organization might elect to adopt CRMA as part of a risk management
initiative but not incorporate it with CCM or CDA at that point. While
this will certainly be beneficial, eventual integration of all three
components will produce synergistic effects. For example, as the CCM
module identifies internal control failures and other issues, this
information can be provided as input to the CRMA program, thus
potentially impacting one or more of the risk measures being monitored,
as well as offering evidence pertaining to whether revision of the risk
profile and corresponding metrics (for example, key risk indicators) is
advisable. Furthermore, as risk measures fluctuate in the CRMA system,
this information can serve as input to the CCM module, allowing it to
proactively address changes in business risk (Moon 2014a). While the
CRMA architecture can add value by itself, it can be fully leveraged when
combined with CCM and CDA to provide a complete system of
continuous auditing and monitoring.
131