AUDIT ANALYTICS AUDIT

AUDIT ANALYTICS AND CONTINUOUS AUDIT:LOOKING TOWARD THE FUTURE
standards were initially instituted by legislation based on the Securities
Act of 1933 and the Securities Exchange Act of 1934 and progressively
developed into the current, ever-evolving set of generally accepted
auditing standards, or GAAS. This formalization of "generally accepted"
has had an enormous effect on business practices and consequently large
effects on the social ecosystem.
Within this context, in addition to the external verification of financial
statements, many contexts in need of third-party verification have risen.
Consequently, organizations developed internal audit departments,
consulting firms introduced auditing services, and some of these needs
are being satisfied on an ad hoc basis mainly by external audit firms.
Vasarhelyi and Alles (2006), in a study for the AICPA’s Enhanced
Business Reporting (EBR) project, characterized the umbrella of
verification services as "assurance," under which falls a set of services
such as the "traditional (external) audit," internal audit, and much of
what we later in this paper call "audit-like services." Several data analytic
and monitoring functions of the expanded set of activities that we hereby
call continuous assurance have dual or multiple functions serving
assurance, management, and other parties. Guidance on materiality,
independence, and required procedures will eventually be needed to
adapt to the new tools as the environment evolves. This essay illustrates
some of these needs.
Groomer and Murthy (1989) and Vasarhelyi and Halper (1991) have
respectively argued for and demonstrated the desirability and possibility
of "closer to the event" assurance processes. This approach, reflecting the
evolution of technology to online, real-time systems, has had slow but
progressive adoption both in practice (Vasarhelyi et al, 2012; ACL 2006;
PWC 2006) 4 and in professional guidance (CICA/AICPA, 1999; IIA, 2005;
ISACA, 2010).
1.1 Continuous Process Auditing
Motivating the need for continuous assurance, Vasarhelyi and Halper
(1991) state: "There are some key problems in auditing large database
systems that traditional auditing (level 1) cannot solve. For example,
given that traditional audits are performed only once a year, audit data
may be gathered long after economic events are recorded." To deal with
these problems, the AICPA/CICA’s Red Book (1999) introduced the
current definition of continuous auditing:
A continuous audit is a methodology that enables independent
auditors to provide written assurance on a subject matter, for
which an entity’s management is responsible, using a series of
4 PricewaterhouseCoopers, Internal Audit Survey; Continuous Audit Gains Momentum, 2006.
4