Continuous Auditing and Continuous Monitoring

Moving Beyond Periodic Audits

Traditional periodic auditing provides a point-in-time assessment of controls and compliance. Continuous auditing and continuous monitoring extend this approach by providing ongoing assurance and real-time oversight. For CISA exam candidates, understanding these concepts and their distinctions is important.

Continuous Auditing

Continuous auditing is the collection of audit evidence and indicators on IT systems, transactions, controls, and processes on a frequent or continuous basis. It is performed by the audit function and is designed to provide assurance on an ongoing basis rather than through periodic audits alone.

Key Characteristics

• Automated procedures test controls and transactions at defined intervals (daily, weekly, or in real time).
• Embedded audit modules within applications can flag exceptions as they occur.
• Results are reviewed by auditors, who investigate exceptions and report findings.
• Reduces the time between control failures and their detection.

Implementation Approaches

• Continuous control assessment: Automated testing of key controls to verify they are operating effectively on an ongoing basis.
• Continuous transaction analysis: Automated testing of transactions against predefined rules to identify anomalies, errors, or potential fraud.
• Continuous risk assessment: Ongoing evaluation of risk indicators to dynamically adjust audit coverage and priorities.

Continuous Monitoring

Continuous monitoring is performed by management (not the audit function) to ensure that policies, procedures, and business processes are operating effectively. It is a management responsibility, distinct from the audit function's continuous auditing activities.

Key Characteristics

• Management designs and implements monitoring processes for its own control environment.
• Includes automated dashboards, key performance indicators (KPIs), and key risk indicators (KRIs).
• Provides early warning of control weaknesses or process failures.
• Feeds into management's internal control assessment and reporting.

Distinguishing the Two

The critical distinction, which is frequently tested on the CISA exam, is who performs the activity:

• Continuous auditing: Performed by the internal audit function to provide independent assurance.
• Continuous monitoring: Performed by management to oversee its own control environment.

These activities are complementary. Strong continuous monitoring by management may allow auditors to reduce the scope or frequency of their continuous auditing activities, while weak monitoring may require more extensive audit coverage.

Benefits of Continuous Approaches

• Timeliness: Issues are identified closer to when they occur, enabling faster response.
• Coverage: Automated procedures can test 100% of transactions rather than relying on samples.
• Efficiency: Reduces manual audit effort while improving coverage.
• Deterrence: The knowledge that transactions are being monitored continuously discourages fraud and policy violations.

CISA Exam Tips

Remember that continuous auditing does not eliminate the need for periodic audits; it supplements them. The audit function should use continuous auditing results to inform its risk-based audit plan and adjust coverage accordingly. Also note that effective continuous auditing requires reliable data feeds, well-defined rules and thresholds, and timely investigation of flagged items.