1. 1

2. Research Topics for Continuous Auditing Mike Groomer Professor of Accounting and Information Systems Kelley School of Business Indiana University

3. 3 Presentation Objectives Continuous auditing defined Conditions necessary for continuous auditing Embedded Audit Modules as a tool for continuous auditing Advantages and disadvantages of EAMs Some research questions Selected research

4. 4 Continuous Auditing Defined “A continuous audit is a methodology that enables independent auditors to provide written assurance on a subject matter using a series of auditors’ reports issued simultaneously with, or a short period after, the occurrence of events underlying the subject matter.” Continuous Auditing, CICA-AICPA, 1999.

6. 6 Conditions Necessary for A Continuous Audit Reliable systems provides the necessary subject matter Subject matter has suitable characteristics High degree of auditor proficiency in IT and audited subject matter Highly automated audit procedures can provide most of the audit evidence Reliable means of obtaining results of audit procedures on a timely basis Timely availability of, and control over, auditors’ reports Management buy-in with highly placed champion

7. Embedded Audit Modules (EAMs) Computer Controls Implementation -- Maintenance -- Security -- Operations Client Application System Client's Computer Environment Input System Audit Objectives Completeness Accuracy Authorization … Others Data Capture EAM Engine & Rules Database EAM Exceptions Database Ad-Hoc Violation Reports on Demand EAM Processing System Audit Objectives Integrity Completeness - Update Accuracy - Update … Others Output System Auditor Maintains Control Over Key to EAM Financial Statements _________ Existence Completeness Accuracy Classification Cutoff Valuation Ownership Presentation

8. 8 Operational Concerns for EAMs Running all the time or turned on at random Do we sample? Control and security concerns for the EAMs

9. 9 Advantages of EAMs Auditor focused control violations and substantive issues captured on a real time basis Exception oriented Provides the ability to ask “what if” on the fly Superior method for trapping errors Surprise testing capability based on significant events

10. 10 Disadvantages of EAMs Requires substantial IS/IT expertise to design and implement Client resistance to a potentially invasive nature of the process Substantial client cooperation? You can’t do EAMs in an environment of unstable systems

11. 11 Some Research Questions Will anyone pay for a continuous audit? – Will a lender be willing to offer lower loan rates for more timely assurance on a loan client’s financials? Will the capital markets value continuous assurance by offering lower cost of capital?

12. 12 Some Research Questions What is the impact of Sarbanes-Oxley on Continuous Auditing ? – Issuers must disclose information on material changes in the financial condition or operations of the issuer on a rapid and current basis (Section 409 - Real time issuer disclosures).

13. 13 Some Research Questions In circumstances where controls are found to be operating effectively, could auditors reasonably conclude that the risk of material errors not being detected and corrected by controls is so low that the performance of substantive procedures to detect errors is not required? If audit procedures involving physical inspection or observation are needed to obtain evidence about a subject matter, how frequently should such procedures be performed in a continuous audit?

14. 14 Some Research Questions Are modifications to auditing standards necessary where continuous audits are present? – Materiality – Risk Model – Nature and form of audit reports With technology as the enabler, how are EAM’s and other audit tools implemented in the context of ERPs?

15. 15 Selected Research Groomer, S. M. and Murthy, U. S. (1989), ‘Continuous auditing of database applications: an embedded audit module approach’, Journal of Information Systems, Vol. 3, No.1, pp. 53-69. Vasarhelyi, M. A. and Halper, F. B. (1991), ‘The continuous audit of on-line systems’, Auditing: A Journal of Practice and Theory, Vol. 10, No. 1, pp.110-125. Kogan, A., Vasarhelyi, M. A., and Sudit, E. F. (1999), ‘Continuous online auditing: A program of research’, Journal of Information Systems, Vol. 13, No. 2, pp. 87–103. Groomer, S. M. and Murthy, U. S. (forthcoming March 2003), ‘Monitoring high volume on-line transaction processing systems using a continuous sampling approach’, International Journal of Auditing.

16. 16