Continuous Controls Monitoring and Continuous Auditing

1
Continuous Controls Monitoring and Continuous
Auditing an integrated technology approach
John Verver CA, CISA, CMC VP Professional
Services ACL Services Ltd
2
Topics

• Continuous Controls Monitoring and Continuous
  Auditing
• Definitions, Distinctions, Relationships
• An integrated approach for CCM and CA
• Management role and activities
• Audits role and activities
• Technology requirements
• Examples

3
Continuous Auditing

• Shift from traditional approach of periodic
  cyclical audit processes
• Method used to automatically perform audit
  procedures on an ongoing basis
• Allows audit to provide ongoing risk and control
  assessments
• Technology is key

4
Continuous Controls Monitoring

• Process performed by management to determine
  whether policies and controls are operating
  effectively
• Establishes control objectives and assurance
  assertions and uses automated tests to identify
  activities and transactions that fail to comply
  with controls
• Allows management to fix control problems on a
  timely basis improves controls and improves
  operational performance
• Technology is key

5
CA and CCM an integrated approach

• Many of the techniques used in CA and CCM are
  similar
• How can both approaches be integrated and how
  does this affect roles and responsibilities of
  audit and management?

6
CA and CCM an integrated approach
7
CA and CCM an integrated approach

• Effective use of automated continuous auditing
  and controls monitoring techniques can
  substantially reduce the time required for ERM
  activities and controls testing
• Helps to make it clear to management that they
  and not audit - are primarily responsible for
  determining effectiveness of controls
• Audit (internal and external) needs to be able to
  rely upon the integrity of the Continuous
  Controls Monitoring process

8
Audit reliance on Continuous Controls Monitoring

• Validation of control monitoring tests
• Design
• Processing
• Security over access to the CCM system
• Security over changes to tests and test
  parameters
• Processing audit trail
• Follow up procedures response to control
  deficiencies detected

9
Technology requirements for Integrated Approach

• Comprehensive range of standard control tests
• Configurability of additional tests
• Ad hoc analysis to support CCM and CA process
• Ability to access and monitor data, transactions
  and activities from across the enterprise
• Security and control over CCM process
• Auditability of CCM process
• Integration with ERM software

10
ACL Experience

• Increasing recognition by internal audit and
  operational management that CCM process should be
  owned by management
• Internal audit designing procedures around CCM
  processes
• External auditing firms beginning to consider
  issues of CCM audit reliance security and
  control of CCM process a significant concern
• ROI argument for CCM repeatedly validated

11
(No Transcript)