Meeting Challenges and Expectations of Continuous Auditing in the Context of Independent Audits of Financial Statements

Abstract

This paper proposes a continuous auditing model that provides external auditors the opportunity to audit clients continuously or on a more frequent basis while reducing the possibility of compromising auditor independence. The model requires the auditor's system to be separated from the auditee's system so that the two systems do not interfere with each other. The auditor's system must also communicate smoothly and effectively with the auditee's system to continuously process data captured from that system. We show how the new technology using XML (eXtensible Markup Language) and CORBA (Common Object Request Broker Architecture) can help effectively connect the auditor's system to the auditee's system, thereby supporting smooth communication between the two independent systems. We also introduce the concept of continuous auditing cycle, which helps define the engagement period between client and auditor and makes the audit within each cycle continuous. SUMMARYThe continuous auditing models proposed in the literature often are developed for internal audit and propose embedded auditing modules for the client's system. This lack of clarity in the literature with regard to the development of continuous auditing approaches for an independent audit of financial statements has perhaps dampened interest in continuous auditing. As a result, the potential application of a continuous audit in the context of an independent audit of financial statements has yet to be explored. The purpose of this paper is to propose a continuous auditing model that provides external auditors the opportunity to audit clients continuously or on a more frequent basis. The model requires the auditor's tool (system) to be independent from the auditee's system so that the two systems do not interfere with each other. Limiting interaction between the auditor's tool and client's system reduces the possibility of compromising auditor independence. The Sarbanes-Oxley Act of 2002 prohibits external auditors from providing information systems tools to audit clients. The auditor's tool must also communicate smoothly and effectively with the auditee's system to continuously process data captured from that system. This means the auditor's tool should work regardless of the proprietary nature of the client's system and the various data formats -this cuts down on the cost of customizing auditor's tool for each client. Our continuous auditing model addresses the above issues. It shows how the new technology using XML (eXtensible Markup Language) and CORBA (Common Object Request Broker Architecture) can help effectively connect the auditor's tool (system) to the auditee's system as frequently as legally desirable, thereby supporting smooth communication between the two independent systems. In the context of independent financial statement audits, the model also allows specifying the frequency of auditing (e.g., daily, weekly, or monthly, and so on). A continuous auditing cycle is introduced to mark the beginning and end of the auditing period per engagement or ...

Automating Vendor Fraud Detection in Enterprise Systems

“…In this approach the continuous monitoring and auditing system is separate from the client's enterprise system. MCLs are stand-alone systems that rely on comparisons of extracted transaction data with pre-determined constraints that allow for continuous monitoring of systems and identification of violations (Du and Roohani, 2007).…”

What is Really Going On at Your Cloud Service Provider? Creating Trustworthy Certifications by Continuous Auditing

“…A permanent communication connection to the auditing object is necessary (i.e., the cloud service). To enable a permanent communication, [15] developed a continuous auditing model, which effectively connects the auditor's systems to the auditee's systems, by using XML and CORBA. Similar auditing architectures include independent monitoring and control layers for continuously querying and analyzing auditing objects [3,42,52,53].…”

“…For example, [30] analyzed the OVAL (Open Vulnerability and Assessment Language) and the XCCDF (Extensible Configuration Checklist Description Format) to enable (semi-) automated IT controls checks, patch and configuration management validation, and vulnerability assessments. The provided tools, processes, and capabilities may differ based upon the extent, kind, and objectives of the used auditing system [15,42,52,53].…”

“…Auditing architectures that may consist of monitoring and control layers [3,42,52,53] and a permanent communication connection to the auditing object [15] as well as integrating different kinds of middleware, standard interfaces [49], or auditing web services [39].…”

Continuous Fraud Detection in Enterprise Systems through Audit Trail Analysis

“…This approach also has a rather long history in the context of information systems dating as far back as 1991 (Vasarhelyi & Halper 1991;Vasarhelyi et al 2004;Kuhn & Sutton 2005;Alles et al 2006;Kuhn & Sutton 2006;Du & Roohani 2007;Li et al 2007). The MCL differs from the EAM in that it is an independent non-integrated software solution that uses middleware to extract data from the enterprise system which is to be monitored.…”