AUDIT ANALYTICS AUDIT

AUDIT ANALYTICS AND CONTINUOUS AUDIT:LOOKING TOWARD THE FUTURE
Designing and instituting a CCM program requires finding a balance
between complexity and flexibility. It must be simple enough for all
personnel to use it correctly, but capable of being tailored to the needs of
customized data sets, disparate system platforms, and unique business
rules. For the CCM program at SFS, the vice president of controls
management chose the ACL Analytics Exchange (AX) platform,
including AX Exception and ACL Analytics. At the most basic level, this
system recursively tests 100 percent of transactional data in the
company’s sub-ledger system for anomalies and control failures, and
notifies the owners of the data about any alerts or exceptions within their
area of responsibility. As a result, process owners would get a higher level
of assurance on data integrity. In addition, process owners and members
of the controls management team can be freed from repetitious manual
tasks and time constraints. Therefore, they can refocus their skills and
energy on specifically flagged areas, and skip information in parts of the
business processes that do not need immediate attention. As an added
benefit, the number of exceptions detected was expected to decrease
over time. Many exceptions come simply from habit, so better
communication of the rules and mechanisms should reduce or eliminate
repetitive problems, resulting in overall consistency and process
improvement.
The data analytics manager at SFS provided a sample of three of the
company’s departments, covering approximately 60 of the 150
exception-type testing algorithms (commonly referred to as "analytics")
in the scope of the CCM program. He noted the substantial
improvements in the average percentage exception rate from the
program’s inception to the present. These analytics cover various
attributes including data input checks, validity checks, and compliance
with regulations and internal policies. As shown in figure A-1, the
consistent reduction in the average exception rates demonstrates an
adherence to controls driven by the continuous monitoring program. For
instance, Department A showed a reduction in percentage exception rate
from 12–14 percent in 2011 and 2012 to 2–4 percent in 2013 and 2014.
Even more strikingly, Department B improved from an exception rate of
21–25 percent in 2011 and 2012 to 2–3 percent in 2013 and 2014, and
Department C improved from an exception rate of 4–6 percent in 2011
and 2012 to less than 1 percent in 2013 and 2014.
150