Companies are affected by external environments that are constantly changing due to new technologies, regulations and economic conditions. With the speed of these changes, audit committees and management are demanding their internal audit functions to provide increased, faster assurance.
To meet these growing expectations, internal audit groups can no longer afford to dedicate significant resources to routine functions as opposed to focusing on new risks arising from these changing environments. A good way to provide assurance on high-volume, stable processes — including procurement, AP, AR, etc. — while reducing resource requirements, is through continuous auditing.
What is continuous auditing?
Continuous auditing is the routine use of electronic auditing tools and methods. Electronic tools offer advantages over the traditional audit process, such as the ability to effectively and efficiently analyze an entire data set, rather than testing by sampling. They also allow you to automate these processes for repetitive performance, creating the ability to schedule analyses at any time.
How continuous is continuous?
“Continuous” has different meanings depending on the business process audited. For example, you may perform a daily audit of potential duplicate invoices but only search for vendors related to employees once a month. In both situations, the audits are on a routine, continual basis. The key is identifying the risk inherent in the process and determining how quickly you can identify potential problems. That speed is the definition of continuous for that process and is, essentially, the speed of your business.
Continuous auditing versus continuous monitoring
The phrases “continuous auditing” and “continuous monitoring” are commonly used interchangeably, but differentiating between the two is important for organizations looking to implement continuous auditing. While the underlying principles are very similar, process ownership and problem resolution differ significantly. Internal audit owns the continuous auditing process and provides results to process owners, e.g., accounts payable directors, for resolution. Management is responsible for continuous monitoring and resolution of identified problems.
Despite these differences, the two processes are closely related, and many procedures are the same in both. Internal audit groups often provide significant value to their companies by developing, testing and finalizing a continuous auditing process; once the kinks are worked out, they provide management with that process as their continuous monitoring process. Continuous auditing and monitoring processes are inversely related — the more monitoring management performs, the less auditing is needed by internal audit. This is a win-win proposition: Internal audit has just provided value to their company while reducing the resource commitment needed to maintain assurance over that control environment.
A multibillion-dollar manufacturing company’s internal audit department performed many electronic tests on an ad hoc basis, using sampling to accomplish its goals. It decided to implement continuous auditing for related-party testing and duplicate payment testing within accounts payable. After identifying risks and designing the tests accordingly, the company can now analyze its entire vendor and employee population (more than 100,000 vendors and nearly 10,000 employees) for potential relationships. In addition, it can analyze more than 2 million payment records for potential duplicate payments with 100 percent coverage.
To begin implementing continuous auditing in your organization, there are three key items to address. The first is risk. A well-designed continuous audit program focuses on key organizational risks. You also will need to identify an electronic audit tool that meets your organization’s needs. With multiple tools available, it is important to research tools and consider the features in relation to your organization’s risks and areas of personnel expertise. Finally, determine what data are available in your accounting systems. This may include conversations with your information technology staff and process owners. This process is integral in designing your continuous auditing program.
After addressing these areas, you are ready to embark on the journey to continuous auditing — auditing at the speed of your business.
For more information, contact a BKD advisor. To reach Selina Wilbur, mail to firstname.lastname@example.org. To reach Jeremy Clopton, mail to Jclopton@bkd.com.
Article reprinted with permission from BKD, LLP, bkd.com. All rights reserved.
Since Normandy Catering Inc. opened its doors, the company has been on a continuous hunt for new areas of business it can break into. Not satisfied with simply filling its 500-person banquet facility on Friday and Saturday nights, the food service company has been growing in niche areas.
Ryan Baker, general manager, and James Carmigiano, vice president, have been expanding Normandy Catering’s niche business in both catering and in food service management.
“Normandy is a family-owned business that started in 1978,” Carmigiano says. “We started doing school food service in 1984, and from there, we started in delivery business and expanded our food service into other schools and higher education.”
It has been the food service side of the business that has really taken off.
“The focus that has caused our growth has been in the food service area versus the catering,” Baker says. “We’ll actually run your kitchen, manage the employees that are there, and we’ll manage the procurement procedures with all of the vendors and produce the food.”
Normandy has seen a lot of growth in this area with schools in Northeast Ohio.
“We can run a public school kitchen by delivering food cheaper than they can actually manage and run their own kitchen with their own people and realize substantial savings while increasing the participation rate that the children are purchasing,” Baker says. “It’s been a win-win and there’s been a lot of growth and a tremendous amount of activity in that section of our business.”
Normandy has also been expanding its service to schools that don’t have kitchens.
“What we’re doing is we’re actually catering the food,” Baker says. “We cook every morning and we deliver breakfast. We set up and have equipment there to serve it. Our people serve it, we clean up and we come back here, load up again and we head out and do lunch. We’re doing a couple thousand a day in those types of meals and there’s been a lot of growth in that area for us.”
The growth Normandy has seen has been due to the effort to find new niche areas that others can’t compete in.
“We decided that there’s only so many Friday’s and Saturday’s in a year for us to load people into our facility and so we’ve gone out and went after this section of the business,” Baker says. “We’ve been here for a long time, but we’re a young, progressive, forward-thinking and hardworking company that really sees a strong future.”
HOW TO REACH: Normandy Catering Inc., (440) 585-5850 or www.normandycatering.com