AUDIT ANALYTICS AUDIT

CASE STUDY B: IMPLEMENTING CONTINUOUS AUDITING AND CONTINUOUSMONITORING
cannot be universally applied because business units have unique
business rules. Exceptions are managed using the CaseWare Monitor
software. The software supports notifications of exceptions, the person
responsible, actions taken, the required time frame and when it has been
resolved. Movement and pending reports have been developed out of
CaseWare Monitor to better analyse the queues. By having greater
visibility over the resolution process, the internal audit group is able to
focus its attention on higher level oversight.
DEFINITIONS AND APPLICATIONS OF CA/CM
IN METCASH
There is a range of definitions used for CA/CM (Hardy 2014). While
some distinctions are based on roles, this was not a significant issue in the
early stages of development in Metcash. The internal audit group led the
development of the CM system. Responsibility for the CM system was
handed over to the business owners after it was fully functioning. At this
stage, the internal audit department played more of an oversight role,
examining trends and reviewing whether business owners were using the
system as intended. This approach supports the view that neither CA or
CM needs "to be present for the other to be implemented" (KPMG 2012b,
3), but by combining them there is a more efficient use of technical and
human resources through coordinated efforts (KPMG 2012b, 3). However,
similar to Vasarhelyi et al. (2012, 275), findings, the monitoring systems
shared between audit and management at the full continuous audit stage
were not being fully used by management. Internal audit was generating
exception reports and monitoring results that were being passed on to
management. There was a degree of uncertainty as to when and how
these exceptions were being acted on. Metcash developed a complete
exception management system to monitor and determine how exceptions
are being actioned by management using the CaseWare Monitor
workflow application. The architecture is discussed in the following.
Definitions of CM that emphasise how weaknesses in control
designs or operations can be identified may also cause some level
of confusion. It is challenging to monitor controls directly. For
example, a review of segregation of duties (SOD) violations may
reveal conflicts, but it does not address mistakes or possible fraud
of authorised users. The continuous review of master data and
transaction exceptions allows inferences to be drawn regarding the
effectiveness of the controls and where gaps may exist. For
example, Metcash policy requires staff to declare related party
interests. In order to confirm that this policy is effective, a CMR
compares changes to the vendor master file to the employee
master file on a daily basis. Matches between the master files on
161