July 26, 2021
One-Click Internal Auditing?
Fast, simple, and inexpensive have become our expectations as consumers. Technology has enabled this rapid shift in how we live and work. But have we advanced to one-click auditing? As quickly as you can order a book on Amazon, can you have your annual internal audit risk coverage? This concept is appealing and we might one day get there. But for now, you can focus on the number of “clicks” it takes to perform internal audits and internal control assessments and how to reduce them.
Terminology Tune-Up
You may have heard about continuous auditing, continuous monitoring, and continuous assurance. While often used interchangeably, and similar, it is important to understand what distinguishes them. The Institute of Internal Auditors defines the terms as follows:
Continuous Auditing
Using computerized techniques to perpetually audit the processing of business transactions.
Continuous Monitoring
The automated review of business processes and controls by associates in the business unit. It helps an organization detect errors, fraud, abuse, and system inefficiencies.
Continuous Assurance
Combination of continuous auditing and audit oversight of continuous monitoring.
All are constructs of Computer Assisted Audit Tools (CAATs). CAATs have long been with us but in recent years new advancements have created opportunities for audit coverage and efficiencies. As new risks emerge, management needs to evaluate how to deploy monitoring and review resources. Continuous auditing can aid in this regard.
Are You Saying? “We’re not large enough to have a data analytics team.”
Often the examples of successful continuous auditing you hear about involve organizations with large internal audit teams with embedded data analytics groups.
Most organizations are not large enough to have dedicated internal audit data analytics teams. However, there are ways to bring these tools into the team and along with them, the efficiency and data to help management make better decisions.
Even small projects require management buy-in to justify the time and resources that will be needed.
The sell is easy: more risk coverage without vastly expanding the team.
Think about the quick wins. Ways to demonstrate to organization executives that investments in tools and time to create repeatable automated auditing programs is valuable to the organization.
| System Access Reviews | Vendor Reviews | Expense Payments |
|---|---|---|
| Reviewing and signing off on system access reports is often tedious, time consuming, and difficult to identify changes from the previous report. However, using tools to merge user access data and human resources data (e.g. new hires, terminations, promotions, or departmental moves) can provide the reviewer a more useful report to ensure access is appropriate or has been removed timely. Repeatable programs can be developed to provide this information on a defined interval. After development, this can be handed over to the business and used as a tool to continuously monitor system access or remain with the internal audit team and used to conduct mini access audits throughout the year. | Crucially important to an organization’s disbursements process, an accurate and controlled vendor table review is an ideal candidate for continuous auditing. Exception criteria for newly created or updated vendors can be defined (e.g. duplicate bank account numbers, missing or incomplete tax ID, etc.) and reviewed at regular intervals. | Given potential balance sheet implications or fraud, large payments made near the financial reporting date are often chosen when sample testing expenses. Reporting on these types of payments can be created and continually audited to ensure they are accurate and properly approved. |
Next Steps
The efficiencies gained by both the business and internal audit will showcase the potential of integrating data analytics tools into the organization. Demonstrating quick wins will result in more opportunities to deploy these tools in reviews.
These combined efforts can move us closer to one-click auditing.
Want to dip your toes into continuous monitoring or auditing, contact the Johnson Lambert team. We have the tools and established processes to help organizations gain efficiencies using new technologies.
