Aiding the Audit: Using the IT Audit as a Springboard for Continuous Controls Monitoring

Demand for continuous controls monitoring (CCM) has increased in recent years as software platforms have matured and ERP systems have become more robust. The question remains of how to effectively implement the CCM model. This study shows how an ERP Certification Audit can be used as a springboard for effectively creating rulebooks and exception reports that both fulfill requirements of the CCM model as well as aid the audit itself. The researcher followed the certification audit of a large, recently acquired software company and worked with the internal audit team to create an automation rulebook based on the parent company's existing audit program. By the end of the systems audit, rules for approximately 63% of the controls tests were successfully automated. Additionally, due to the homogeneity of the parent company's information systems, the rulebooks and reports created can be easily adapted for use with other subsidiaries without the need to repeat the entire creation process. This paper details the benefits and limitations of using the IT audit as a conduit for CCM implementation.