AUDIT ANALYTICS AUDIT

AUDIT ANALYTICS AND CONTINUOUS AUDIT:LOOKING TOWARD THE FUTURE
ask of each activity during this phase is "What can go wrong?" because
this will enhance discovery of relevant task characteristics such as how
an activity can fail, how much risk exists, and the probability of
occurrence and impact of potential risk exposure. Once all risks are
identified and a profile is constructed, efforts gravitate toward the
formulation and implementation of a meaningful set of KRIs able to
productively monitor the risk environment.
KRI Development and Implementation
Key risk indicators are "metrics used by an organization to provide an
early signal of increasing risk exposures in various areas of the
enterprise" (CEB 2013). Each KRI should be a root cause identifier or a
leading indicator of risk, such that a proactive response can be made in
addressing detected problems. However, achieving this in practice is a
non-trivial task. In a recent ERM function survey, 56 percent of
respondents indicated the greatest difficulty in KRI development is
establishing metrics that are leading indicators of risk (CEB 2013).
Therefore, serious attention must be devoted to KRI construction. For
example, if the inability to settle current liabilities is an identified risk,
several potential KRIs might be envisioned, but many would be
suboptimal. The current ratio might initially be suggested as a potential
KRI in this situation, but at the point when this measure is indicative of a
problem, it could be too late to prevent occurrence of the underlying risk
event. Conversely, customer financial health trend information is a
leading and more suitable KRI. In this case, if significant financial
deterioration in the customer base is detected, then more effective
corrective measures could be enacted to avoid having insufficient
liquidity in clearing current liabilities as they mature.
Moon (2014a) argues each KRI must possess two fundamental
characteristics. First, it has to be measurable, but need not be purely
objective. A KRI can be relatively subjective provided it is independently
quantifiable and verifiable (Scandizzo 2005). For instance, information
arising via text mining and sentiment analysis of news feeds and other
electronic media could be synthesized in generating an effective KRI. In
an application of this approach, relevant textual information is regularly
analyzed, and variables such as information source quality, frequency
and timing of news, and severity level of content are all determined and
aggregated in computing an entity’s reputation risk score (RepRisk 2014).
On the other hand, for the identified risk of manipulative earnings
management, one might view tone-at-the-top as a potential KRI. The
underlying rationale might be that this variable is highly correlated with
organizational culture as well as the propensity for unethical behavior.
However, evaluating tone-at-the-top would prove extremely challenging
from the standpoint of measurability, and if the proposed KRI is not
134