Continuous Auditing Global Technology Auditing Guide 3 Twelfth Continuous Auditing and Reporting Symposium Rutgers Business School November 3, 2006

Institute of Internal Auditors Advocating and promoting the value that internal audit professionals add to their organizations; Providing comprehensive professional educational and development opportunities; Researching, disseminating, and promoting to practitioners and stakeholders knowledge; Educating practitioners and other relevant audiences on best practices in internal auditing; and Bringing together internal auditors from all countries to share information and experiences. The Institute of Internal Auditors is a global professional association with more than 122,000 members, and is recognized as the internal audit professions leader in certification, education, research and technical guidance. Its mission includes:

GTAG Written primarily for the chief internal audit executive (CAE) and audit supervisors, the guides address concerns of the board of directors and chief-level executives. Each Global Technology Audit Guide (GTAG) is written in straightforward business language to address timely issues related to information technology management, control, or security. GTAG is a ready resource series for chief audit executives to use in the education of members of the board and audit committee, management, process owners, and others regarding technology-associated risks and recommended practices.

What This Guide Covers Role of continuous auditing in today’s internal audit environment Relationship of continuous auditing, continuous monitoring, and continuous assurance The application and implementation of continuous auditing Benefits of a continuous, integrated approach

Role of Continuous Auditing Today’s audit challenges –Regulatory compliance & controls –Internal audit value and independence –Availability of skilled resources –Determining appropriate technology solutions Need for timely, ongoing assurance over risk management and control systems Role of continuous auditing –Provides more frequent, more timely, analyses to better manage control deficiencies and risk

Gaining Clarity: Some Definitions Continuous Auditing –Method used to perform audit-related activities on a continuous basis – includes control and risk assessment –Performed by Internal Audit Continuous Monitoring –Processes to ensure policies/processes are operating effectively and to assess adequacy/effectiveness of controls –Performed by operational/financial management; audit independently evaluates adequacy of management activities Continuous Assurance –Combination of continuous auditing and audit oversight of continuous monitoring

Relationship of Continuous Auditing/Monitoring/Assurance Role of continuous auditing dependent on management’s role in continuous monitoring of controls –Inverse relationship: the greater the role of management, the less of a direct role of internal audit True continuous assurance –Depends on effective monitoring by management of internal controls and Audit’s independent assessment of that function

Application Areas Continuous control assessment –Identification of control deficiencies –Identification of fraud, waste, abuse Continuous risk assessment –Examination of consistency of processes –Development of enterprise audit plan –Support to individual audits –Follow-up on audit recommendations

Key Steps to Implementation Establish audit objectives and requirements Gain executive-level support Ascertain degree to which management is performing monitoring role Select appropriate technology solutions Identify information sources and gain access Understand business processes and identify key controls and risks Build audit skill set Manage and report results

Benefits Increased scope of audit activities Increased ability to mitigate risk Reduced cost of internal control assessment Increased confidence in financial results Improvements to financial operations Reduced financial errors and potential for fraud Reduced revenue leakage for improved bottom-line results Sustainable and cost-effective means to support compliance