Flashes of brilliance - role of information system auditors

Internal Auditor, June, 1994 by Sara S. Patterson, Kimberly A. Svevo-Cianci

"In continuous process auditing," Cangemi said, "the computer itself identifies areas where you will want to spend more audit time because there may be unusual activity." The continuous process audit would identify this activity through constant review of analytics. "Only a few organizations that I know of are doing this," he continued. "This goes beyond the traditional audit. Some banks are using it, and AT&T is using it on its billing system to track unusual variances in the billing patterns. These tools can definitely enhance productivity and focus auditors on high-risk areas."

Why are so few organizations engaged in continuous process auditing? What are the costs for the delay? The answers to these questions resist generalization. However, one common factor is a slow shift to support for creative approaches in auditing. Yet the significant investment being made in technology suggests that people will increasingly make the time to work on incorporating continuous auditing into the system.

Systems Measuring System Quality

David Holcombe, Director of Auditing Services at Pacific Bell, emphasizes the importance of improving the accuracy or quality of information available through the design of a system that accurately measures system quality. It is a major breakthrough in showing users and management how good their information is, according to Holcombe.

"Good information gathering drives continuous improvement," Holcombe said. "Once you can measure the quality, you can improve it. Your decisions become easy to make and understand. That equates to plenty of manpower and cost savings."

When an organization does not know that the quality of its information is poor, it misses opportunities or opens itself to large risks. "We have been able to find additional revenue or reduce expenses by finding errors in the process," Holcombe stated. "Measuring quality also enhances relationships with customers and regulators. You can provide them with certifiable information, using measurement processes that they can intuitively look at and understand. This helps to inspire an image of certainty and trust. Users wholly support and endorse the processes they have. The results impress their customers and industry regulators. That's exciting!

"Now the IS community can prove how good it is. The auditor gets the highest level of comfort and understanding of the day-to-day operations, with systems handling over two hundred million transactions per day."

Within each industry and even within each organization, the strategy and plan to develop the systems that measure system quality are unique. Holcombe notes that the first thing an auditor must do is to understand what accounting functions are being used, such as handling inventory, customer accounts, and allocations of revenues and expenses.

"The business relies on these transactions to achieve its profit," Holcombe stressed. "What needs to be checked? What are the difficulties with checking them? How valuable are the results of checking?