Page 471 - ITGC_Audit Guides

GTAG — Foundational Continuous Assurance Framework

Ongoing control assessments need not run in real-time. The Used effectively, continuous monitoring can:
frequency of analysis should be determined by the level of
risk, the business process cycle, and the degree to which • Enhance the ability to promptly identify and curtail
management is monitoring the controls. For example: control problems.
• Reduce incidences of error and fraud.
• Purchase card analytics might be run once a month, • Enhance operational efficiency.
upon receipt of the purchase card transactions from • Improve bottom-line results through a combination of
the credit card company. cost savings and a reduction in overpayments and lost
• Payroll might be run every pay period, in sync with revenue.
direct deposit transactions. • Improve customer satisfaction through enhanced
• Tests for duplicate invoices and payments might be customer service quality and integrity.
run every day.
• Changes to automated controls tend to be infrequent
and might be monitored in sync with the IT routine
release cycle.
• Operating system patching might be scanned
quarterly.

In some cases, an auditor may perform the initial
control testing and transition the ongoing monitoring to
management.

Ongoing control assessment results, organized by process,
should:
• Support audit objectives.
• Communicate:
o Conditions of key controls, such as security
capabilities.
o Changes to automated controls.

Continuous Monitoring
Management should own and perform continuous
monitoring. Many of the techniques management uses to
continuously monitor controls are similar to continuous
auditing techniques used by internal auditors. Continuous
monitoring principles include:

• Purpose – consider the business objective and critical
success factors.
• Risk – determine likely obstacles that would inhibit
the organization’s success.
• Response – align diverse sources of data to discover
and corroborate emerging risks such as configurable
conditions, changes, event logging, financial
transactions, and unstructured data.
• Timing – detect control issues in real time.
• Action – track deficiencies for corrective action.

6