ACCT 332 Week 8 Research Paper: Final Example

Assurance at the Speed of Transactions: Continuous Monitoring and Continuous Auditing in Accounting Information Systems

Abstract

Continuous monitoring and continuous auditing apply automated tests to accounting transactions and controls as they happen instead of months afterward. This paper traces their path from academic proposals into practice, weighs the evidence on what they deliver and identifies what holds them back. Firms that monitor controls with technology report fewer material weaknesses and see audit costs rise more slowly, and daily automated testing has proven workable in practice. Adoption nevertheless remains partial, because procedures, skills and the handling of exceptions must change along with software. A staged plan for mid-sized organizations, starting with rule-based, high-volume controls, is recommended.

Introduction

In the finance office of a mid-sized distributor where I interned, a vendor was paid twice for the same $18,400 shipment of packaging film. The second payment went out in early March; it was discovered in late May, during a quarterly review of vendor statements, eleven weeks after the money left the company. Nothing about the error was hidden. Both invoices sat in the payables system the whole time, with the same vendor, amount and purchase order. The problem was timing: the organization looked at its transactions only periodically, and periodic review is slow by design.

Continuous monitoring and continuous auditing aim to close that gap by testing transactions and controls as they occur. This paper asks how far these techniques have moved from theory into practice and what limits their use. It argues that continuous techniques have proven their worth where accounting processes follow clear rules, such as payables, payroll and access controls, but that adoption remains partial because organizations must change audit procedures, staff skills and the handling of exceptions, not merely install software.

Definitions

The two terms are related but not interchangeable. Continuous monitoring is management's ongoing, automated review of its own transactions and controls, part of the monitoring component of internal control that Richardson et al. (2018) describe as essential to a reliable accounting information system. Continuous auditing is the use of similar techniques by internal or external auditors to provide assurance close to the time events occur. Chan and Vasarhelyi (2011) explain that continuous auditing changes more than the calendar. It alters the frequency of testing, the share handled by software, the portion of each population can be examined and what auditors spend their time doing, with work shifting from gathering evidence toward investigating exceptions. The distinction matters because an auditor who relies on management's monitoring must first establish that the monitoring works; otherwise the system being examined is effectively reporting on itself.

From Proposal to Practice

Continuous auditing began as an academic idea that preceded the technology to support it widely. By 2007, Brown et al. (2007) could identify more than 80 papers on the subject and sort them into five research streams, running from why organizations want continuous auditing to the technology behind it and the effects of using it. Their review found the least work on impacts, which is the stream that matters most to an organization deciding whether to invest. A year later, Alles et al. (2008) reported lessons from pilot projects with two large firms and cited survey evidence that roughly half of responding firms were using some continuous auditing techniques, with most of the rest planning to. The field's distinctive feature, they noted, was that academic researchers had led a major change in practice rather than following it.

The pilots also revealed a pattern that later research confirmed: automating an existing audit procedure is the easy part; deciding which procedures should change once every transaction can be examined is the hard part, and that question has shaped the field ever since. A traditional audit plan assumes that evidence is expensive, so it chooses a small sample, tests it carefully and extends the conclusion to the population. When evidence becomes cheap, because software can read every record, that logic weakens. The auditor no longer needs to infer what the population contains; the open question becomes what to do with the hundreds of items the software flags and how to decide which of them matter. Much of the research since 2008 can be read as an attempt to answer that question.

Evidence on What Continuous Techniques Deliver

The strongest large-sample evidence concerns continuous monitoring of internal controls. Masli et al. (2010) studied firms that adopted technology to monitor control effectiveness in response to the Sarbanes-Oxley Act. Compared with other firms, adopters were less likely to report material weaknesses in internal control, and their audit fees and audit delays grew less in the post-SOX period. The finding is important because it ties monitoring to outcomes that auditors, investors and regulators all care about. It also has a limit: firms that chose to invest in monitoring were probably unlike other firms in further respects, management's interest in controls among them, so the study shows an association rather than proof that the technology alone produced the benefits.

Case evidence fills in how the benefits arise. Hardy and Laslett (2015) describe the business assurance group of Metcash, an Australian wholesale distributor, which built a program of more than 100 automated tests run every day, connected to an integrated system for managing the exceptions the tests produced. The group moved over time from simple data extraction toward predictive analytics and used visualization to report results to management. The case shows that daily continuous testing is workable at scale in an ordinary commercial company, not only in banks or technology firms, although the authors are frank that the outcome came with challenges in skills, data access and organizational support.

Read side by side, the archival studies and the field cases agree on direction while addressing separate questions. The large-sample study shows that monitoring is associated with better control outcomes across many firms, while the case study shows the practical mechanics in one firm. Neither measures the dollars recovered or the frauds prevented, which is what a chief financial officer weighing the investment would most like to know. That gap is partly a matter of confidentiality, since companies rarely publish the errors their systems catch, and partly a matter of research design, since it is hard to count losses that never happened. It means that the business case for continuous techniques still rests partly on judgment, informed by evidence on controls and by the experience of organizations that have tried them.

How Continuous Systems Are Built

Kogan et al. (2014) offer the clearest design. Their system has two layers. The first checks each transaction against deterministic business rules, such as a requirement that every payment match an approved purchase order and a receiving record; violations are exceptions that must be resolved. The second layer applies analytical models to detect anomalies, transactions that break no rule but look unusual compared with expected patterns, such as a sudden rise in purchases from one vendor. Using procurement data from a large health care provider, the authors simulated the system and found that auditing complete data continuously could produce superior results, but only when audit practice changed to make use of the data now available.

The design rests on concepts from the course. Rule-based tests depend on well-structured data, with keys that link payments to purchase orders and receiving records, the kind of relational design Richardson et al. (2018) present in their database chapters. A payables system in which payments cannot be traced to their source documents cannot be monitored continuously, whatever software is bought. Clean master data matters just as much. If the same vendor appears under three slightly different names, a duplicate payment test will miss pairs split across the records, so the first project in many organizations is a cleanup of the vendor master file, merging duplicates and requiring a tax identification number for every active vendor. That work is unglamorous, but it is what makes later tests trustworthy, and it often uncovers problems of its own, such as inactive vendors still eligible for payment. In the distributor's case, the duplicate payment would have been caught on the day it was made by a single first-layer rule: flag any payment matching an earlier one on vendor, amount and purchase order.

The two layers also divide work sensibly between management and auditors. First-layer rules are natural candidates for continuous monitoring by management, because they enforce policies management itself has set, and their exceptions usually call for correction rather than investigation. Second-layer anomaly detection fits continuous auditing better, because judging whether an unusual pattern signals error, fraud or a legitimate change in the business requires the skepticism and independence auditors are expected to bring. An organization that understands this division can avoid a common mistake, asking auditors to clear routine rule violations that the process owners should fix, which wastes the auditors' time and blurs who is responsible for the controls.

What Holds Adoption Back

If continuous techniques work, why are they not universal? The research points to three barriers. The first is exception overload. Full-population tests flag far more items than a sample ever would, and many flags turn out to be harmless. Kogan et al. (2014) found that the benefits of continuous auditing depended on changing audit practice to deal with exceptions, and an organization that switches on dozens of tests without assigning someone to resolve their results soon learns to ignore them.

The second barrier is that professional guidance grew up around sampling. Appelbaum et al. (2017) set the standards governing audit evidence and analytical procedures against the reality of clients that run on big data, cloud systems and complex analytics, and they find that the standards have not kept pace. Auditors who test every transaction still face questions about how to document and justify conclusions drawn from analytics rather than from a sample with a known confidence level.

The third barrier is people. The Metcash case shows that skills in data extraction, analysis and communication were as important as the software (Hardy & Laslett, 2015). Recent work points the same way: Huang et al. (2022) argue that audit data analytics and machine learning make full-population testing feasible and sampling less meaningful, but the approach they describe assumes auditors who can build, interpret and challenge analytic models. Organizations that lack those skills tend to adopt continuous techniques in pieces, automating a few familiar tests and leaving the rest of the audit unchanged.

These barriers reinforce each other. Without skilled staff, an organization cannot tune its tests, so false alarms stay high; with false alarms high, managers lose confidence and stop resolving exceptions; and without a record of resolved exceptions, auditors have little basis for relying on the monitoring. Breaking the cycle requires starting where tests are precise and exceptions are few, which is the logic of the plan that follows.

A Staged Plan for a Mid-Sized Distributor

For an organization like the distributor where the duplicate payment occurred, the evidence suggests a staged approach rather than a single large project. In the first stage, management should automate a small set of first-layer rules in processes with high volume and clear rules: duplicate payments, payments to vendors without approved master file records, payments above approval limits and changes to vendor bank details. Each test should have a named owner responsible for resolving its exceptions within a set number of days, because tests without owners quickly become noise.

In the second stage, after the exception process works, the organization can add analytical tests, such as unusual growth in purchases from a single vendor or round-dollar invoices, and begin to track how many flags prove real, retiring tests that mostly produce false alarms. A simple monthly report, listing each test, the number of flags, the number confirmed and the dollars involved, would give the controller and the audit committee a way to judge whether the program is earning its cost. If a test runs for a quarter without a single confirmed exception, it should be redesigned or dropped, so that staff attention goes where problems actually occur. In the third stage, internal audit can shift from sampling payables to testing management's monitoring itself, reperforming a selection of tests independently each year. This sequence follows the research: it builds the exception handling that Kogan et al. (2014) found necessary, it develops skills gradually as the Metcash case suggests and it aims at the control benefits Masli et al. (2010) associate with monitoring technology.

For a Christian accountant, continuous monitoring also reflects a familiar principle of stewardship. Proverbs 27:23 urges the herder to stay closely acquainted with each flock and attentive to the herds (English Standard Version Bible, 2001/2016). Watching over resources as they are used, rather than discovering losses months later, is a modern form of that attentiveness, and it protects the people whose money the organization holds.

Conclusion

How far have continuous monitoring and continuous auditing moved from theory into practice, and what limits them? The evidence reviewed here suggests that both have moved a long way. Monitoring technology is associated with stronger internal control and slower growth in audit costs, practical designs exist for testing complete data and companies such as Metcash run continuous testing every day. Adoption nonetheless remains partial, because the techniques require new procedures for handling exceptions, guidance that has not caught up with analytics and skills many organizations are still building. This body of work is uneven. A large share rests on single cases and pilot projects, and the strongest large-sample study shows association rather than cause. For a mid-sized organization, the practical conclusion is to begin small, with rule-based tests and owners for every exception, and to expand as people and procedures change. The duplicate payment that took eleven weeks to find would, under that plan, have been found the same afternoon.

References

Alles, M. G., Kogan, A., & Vasarhelyi, M. A. (2008). Putting continuous auditing theory into practice: Lessons from two pilot implementations. Journal of Information Systems, 22(2), 195-214. https://doi.org/10.2308/jis.2008.22.2.195

Appelbaum, D., Kogan, A., & Vasarhelyi, M. A. (2017). Big data and analytics in the modern audit engagement: Research needs. Auditing: A Journal of Practice & Theory, 36(4), 1-27. https://doi.org/10.2308/ajpt-51684

Brown, C. E., Wong, J. A., & Baldwin, A. A. (2007). A review and analysis of the existing research streams in continuous auditing. Journal of Emerging Technologies in Accounting, 4(1), 1-28. https://doi.org/10.2308/jeta.2007.4.1.1

Chan, D. Y., & Vasarhelyi, M. A. (2011). Innovation and practice of continuous auditing. International Journal of Accounting Information Systems, 12(2), 152-160. https://doi.org/10.1016/j.accinf.2011.01.001

English Standard Version Bible. (2016). Crossway. (Original work published 2001)

Hardy, C. A., & Laslett, G. (2015). Continuous auditing and monitoring in practice: Lessons from Metcash's business assurance group. Journal of Information Systems, 29(2), 183-194. https://doi.org/10.2308/isys-50969

Huang, F., No, W. G., Vasarhelyi, M. A., & Yan, Z. (2022). Audit data analytics, machine learning, and full population testing. The Journal of Finance and Data Science, 8, 138-144. https://doi.org/10.1016/j.jfds.2022.05.002

Kogan, A., Alles, M. G., Vasarhelyi, M. A., & Wu, J. (2014). Design and evaluation of a continuous data level auditing system. Auditing: A Journal of Practice & Theory, 33(4), 221-245. https://doi.org/10.2308/ajpt-50844

Masli, A., Peters, G. F., Richardson, V. J., & Sanchez, J. M. (2010). Examining the potential benefits of internal control monitoring technology. The Accounting Review, 85(3), 1001-1034. https://doi.org/10.2308/accr.2010.85.3.1001

Richardson, V. J., Chang, C. J., & Smith, R. (2018). Accounting information systems (2nd ed.). McGraw-Hill Education.