AUDIT ANALYTICS AUDIT

CASE STUDY A: DEVELOPING CONTINUOUS ASSURANCE AT SIEMENS
Figure A-2: CCM as a Preventive Control to Improve the Closing
Process
Of course, the way that the CCM functions within an organization’s
internal control system depends on the specific structure of the
organization’s bookkeeping system. For example, if an organization posts
to the general ledger monthly, then the CCM operates as a preventive
control because it catches errors before they are posted. Alternatively, if
transactions are posted daily, then the CCM serves as a detective and
corrective control because it fixes errors after they are posted.
To a large extent, internal control specialists are the architects of an
organization’s analytic tools because they have a unique awareness of the
risks and controls, as well as the kinds of information and the
information formats that will be needed by managers for
decision-making and by internal and external auditors for risk
assessment and assurance purposes. For example, the AX system has a
naturally auditable log function that constantly tracks actions performed
in the CCM program to provide a solid trail in one direction to the way
that exceptions were derived, and in the other direction to subordinate
clean results that may be relied upon by both internal and external
auditors. This creates an audit trail that facilitates both internal and
external audit activities. Thus, the AX log not only finds exceptions and
monitors their resolution, but also reports on exceptions and keeps a log
of clean results that serve as evidence on the correctness of the residual
data. As an added benefit, this is a tool that the external auditors easily
understand and trust because they already use this software application
in their work. AX has also streamlined the processes necessary to comply
with requirements for internal controls over financial reporting under
SOX and ICFR (internal control over financial reporting). SFS no longer
needs to sample the functionality of selected internal controls that have
already been migrated to CCM for Section 404 reporting because the
system has already tested 100 percent of the population, giving the
external auditors a high level of reliance on the data as they plan the
timing, nature, and scope of the audit. It also eases the client’s burden to
provide sample-based data to the auditors and streamlines or eliminates
the need for management assurance testing.
The vice president of controls management sees the CCM system
primarily as a tool of management. For each managerial decision, the
153