Ryan A. Teeter

Aiding the Audit: Using the IT Audit as a Springboard for Continuous Controls Monitoring

Demand for continuous monitoring of internal controls by large firms has increased in recent years as enterprise resource planning (ERP) systems have become more robust and monitoring platforms have matured. The question remains of how to effectively implement the continuous controls monitoring (CCM) model. We followed the IT audit of a large, recently acquired software company and worked with the internal audit team to create an set of automated rules based on the parent companys existing audit program. By the end of the systems audit, rules for approximately 63% of the controls tests were successfully automated. Additionally, due to the homogeneity of the parent companys information systems, the sets of rules and reports created can be easily scaled up for use with other subsidiaries without the need to repeat the entire creation process. This paper details the benefits and limitations of using the IT audit as a model for CCM implementation.