AUDIT ANALYTICS AUDIT

AUDIT ANALYTICS AND CONTINUOUS AUDIT:LOOKING TOWARD THE FUTURE
Figure B-1: The Architecture
(Source: Hardy and Laslett, forthcoming)
Commercially available software is used, incorporating ACL, CaseWare
Monitor, ACL Direct Link for SAP, Windows Scheduler, and Excel
spreadsheets, each serving different purposes (Hardy and Laslett,
forthcoming). A CA/CM system based on spreadsheets is not
sustainable. A robust architecture is required that supports the
identification of exceptions, and provides assurances that the exceptions
have been actioned by relevant parties and that the exception data is
retained and secured appropriately. The need for a "robust" database to
manage and store large and growing amounts of data is not new (Alles,
et al. 2008, 150). However, it was a challenge for the internal audit group
as they were responsible for the acquisition, maintenance, and security of
the CA/CM infrastructure. The IT department viewed this as an
end-user responsibility.
The architecture consists of three component areas: (1) data extraction; (2)
data transformation; and (3) loading of exception data into user
accessible exception management software. This is broadly based on a
monitoring and control layer (MCL) type of approach (Vasarhelyi et al.
2004). As shown in figure B-1, ACL Direct Link is used to extract data
from the ERP (SAP) system. Non-SAP data requires other extraction
techniques. ACL is used to transform different native file formats and
execute the scripts. Experience has shown that vendor pre-written scripts
160