Theory to practice: continuous auditing gains.

• Author: Heffes, Ellen M.
• Position: Financial REPORTING - Internal auditing

In the wake of Sarbanes-Oxley, chief audit executives (CAEs) are rethinking their strategies for internal audit. Among the challenges they face is the need for much more timely identification of risk and control issues. In today's environment of constant change, coupled with increased expectations on control and governance, CAEs find the traditional annual audit process insufficient. Waiting for an annual audit to identify a control weakness may be too little, too late.

The need for more timely and reliable risk and control assurance has encouraged internal auditors to revisit the theory and practice of continuous auditing. The theory is not new. As a concept, continuous auditing has been explored in internal audit circles since the 1970s. Conceptually, the approach revolves around a process focused on the monitoring and/or auditing of key risks and controls on a real-time basis. This process may involve the use of technology. While there have been many attempts to implement the concept of continuous auditing, few organizations have realized its full vision and potential.

To learn more about how internal audit departments are addressing the need for more timely risk and control assurance, PricewaterhouseCoopers conducted its second annual "2006 State of the Internal Audit Profession Study." The study, which included input from over 400 internal audit executives, found that CAEs are actively pursuing strategies designed to shorten audit cycle times and provide more timely risk and control assurance. This quest is prompting renewed interest in the practice of continuous auditing.

As the 2006 study confirms, the term "continuous" is more a concept than a practice today. Practices vary and may involve a combination of both computer-assisted audit programs and manual procedures. This monitoring or auditing is "continuous" in relatively few cases--and, in those rare instances, usually involves repetition of both automated and manual audit procedures. However, there is a clear trend in the majority of departments surveyed towards the implementation of the continuous auditing concept.

Other findings of the PwC study include:

* More than 80 percent of the nearly 400 companies responding to questions about continuous auditing said they either had a continuous auditing or monitoring process in place or were planning on developing one.

* Half of the 2006 survey respondents have some form of continuous auditing or monitoring process within their...