AUDIT ANALYTICS AUDIT

CASE STUDY A: DEVELOPING CONTINUOUS ASSURANCE AT SIEMENS
role as vice president of controls management at SFS, he observed that
many of the company’s internal audit programs, such as audit checklists,
are mechanical and repetitive in nature, so he wanted to automate these
processes by moving to a CCM program as an independent control
assurance function that would be separate from internal audit.
Recognizing that organizations are often resistant to change, he decided
to start with small, achievable targets to demonstrate that the program
has merit, and then expand beyond financial reporting into operational
components once the business unit and support unit managers at SFS
had become accustomed to the continuous monitoring methodology.
In the first phase of the project, the new vice president of controls
management focused on financial reporting rules compliance and data
integrity. Personnel at SFS manage data and make decisions within a
framework of company policies expressed as a set of rules. Because SFS
relies on communicating rules and assessing compliance with those rules
in providing services to its clients, the first part of the project was to
develop a system that could notify key people within the company about
"exceptions" and "alerts." An exception demands immediate research and
resolution because it means that a rule was not followed. Depending on
the explanation that is given for the exception, it might also require a
correcting entry in the SFS accounting records. By contrast, an alert flags
any transaction that might be of interest to the owners of that
information, such as a change in a transaction, so that SFS can take
immediate action to verify the information and be proactive in
monitoring the business.
Implementing a CCM program would enhance business processes at SFS
by immediately identifying any exceptions to the company’s system of
rules and policies by internal decision-makers, notifying them of these
exceptions, and demanding resolution. The CCM system would also
improve the company’s financial assurance processes, such as SOX
requirements, by monitoring the entire data population, instead of
relying on the types of sample testing used in traditional SOX or internal
audit methodologies. According to the vice president of controls
management, "Exceptions in the data pool are like fish in the lake. Just
because they are there doesn’t mean you will catch any." Continuously
assessing 100 percent of data attributes (validity, authorization,
completeness, valuation, time period, and disclosure) for exceptions
gives far greater assurance that the data represents the company’s
underlying economic position than periodic sampling ever could. In
addition, the immediacy of the CCM’s feedback raises decision-makers’
cultural and behavioral awareness of rules at SFS, which further
enhances its value as a tool and a methodology.
149