AUDIT ANALYTICS AUDIT

ESSAY 1: CONTINUOUS AUDITING—A NEW VIEW
internal controls within a highly formalized and well-controlled
enterprise resource planning environment. Utilizing the IT audit
plan as a template, auditor expertise as a guide, and manual audit
output as a validation tool, this field study examines the process of
audit formalization and implementation of CCM at a software
division of a large, multinational corporation. (Teeter, 2014)
The results of the applied effort 5 indicated that 62 percent of the controls
arguably could be formalized, creating the possibility of a control
certification or assurance layer on top of the SAP instance. Conceptually,
this layer could be a part of SAP or an add-on, could be generic in
configuration or tailored to the instance, and could be re-thought as a
way to increase audit coverage as the original audit plan was applied in
an 18- to 24-month cycle, and under this design this layer would be
executed every day. Furthermore, the audit plan contained many
qualitative questions such as "Is there documentation for XYZ system?"
Elder et al. (2013) narrate a continuous monitoring effort at a large South
American bank in which internal audit monitored 18 different key
performance indicators (KPIs) for over 1400 branches of a bank. Daily
extracts of variances were obtained and, on a selective basis, followed up
by emails to the regional managers for the branches. These KPIs looked
to control overrides such as credit above allowable level or reversal of
certain types of transactions.
These examples illustrate (1) situations where auditors were in positions
of control over operational controls, which could result in a conflict to the
auditor’s objectivity or independence and (2) that technology has
changed the needs, capabilities, and roles of the assurance function. As
suggested earlier, a more flexible set of conceptualizations must evolve,
concerning auditor independence in particular. These examples are
focused on internal auditors, but a similar monitoring role could be
developed for external auditors and an ongoing monitoring opinion
could potentially be issued as a new CPA product.
Figure 1-2 describes the vision developed for multi-instances of ERPs and
an analytic engine supporting a set of functions. This view, however,
could be immediately after the event based on the two experiences
described above and would be an ex-post-facto overnight process, which
we would describe as retroactive close to the event meta-control or
assurance process.
5 Private notes Teeter, R.A., Warren, J.D., Brennan, R., and Vasarhelyi, M.A. 2007.
9