AUDIT ANALYTICS AUDIT

ESSAY 1: CONTINUOUS AUDITING—A NEW VIEW
to monitoring operations. Investors may primarily be interested in data
assurance though, depending on the industry, compliance and risk
monitoring may be equally as important.
CA is well suited for historic analyses, particularly given the speed with
which CA provides information on attributes such as accuracy. Auditors
that provide assurance on historic information will likely be primarily
interested in the ability of CA to be used for such purpose. Access to
sophisticated ERPs and complex data sets create an opportunity for CA
to be used for diagnostic purposes. Where an error or anomaly has been
identified, CA may perform a retrospective diagnostic of the
situation—providing insight and analyses to management.
Diagnostically, CA could also be tied to effectively assessing operational
and structural strengths and weaknesses of an organization—enabling
strategic decisions to be made in a timely manner and with sufficient
context.
Automation is an essential element to CA, though manual involvement
remains important particularly in situations where extensive judgment is
required and where anomalies, exceptions, and outliers are identified.
Continuous Data Audit CDA
Vasarhelyi and Halper called the process of monitoring and constantly
assuring AT&T’s RCAM system continuous audit. The architecture of the
system described in figure 1-1 shows data being (1) extracted from
pre-existing reports, (2) sent to the business units through the remote job
entry network, (3) transferred to an email system, and (4) extracted
through individual text mining programs. This technique, analogous to
what is called today "screen scrapping," was chosen to avoid interference
in the long and complex system process development protocol. All
information was collected from existing reports and placed in a relational
database. This database drove hypertext graphs that were given to
auditors to interact with the system. The several layers of the RCAM
system were represented as flowcharts respecting the internal auditors’
documentation practices and experience in data analysis. Many of the
analytics impounded into the system were drawn from knowledge
engineering (Halper, Snively, and Vasarhelyi, 1989) internal auditors and
capturing the calculations they made with paper reports. The
formalization of these processes allowed for their repetition at repeated
frequency, and often reliance on these tests up to the moment that alerts
were generated. Although internal auditors started relying on these
exception reports, they also requested that the source reports be retained
mainly for their traditional audit reports.
7