What Is Continuous Auditing?

In his article, Sarva uses the definition from the Institute of Internal Auditors,
2
which has been
quoted many times in the literature. It states that continuous audit is a means to issue an audit
report simultaneously or immediately after the event in question. This is a workable definition;
however, it is only part of the story. After all, auditors could use continuous auditing methods
to deliver their normal once-a-year opinion on the accounts. A more complete definition would
include continuous monitoring, continuous auditing and continuous assurance as separate
concepts. These are similar to the definitions put forward by the Institute of Internal Auditors in
a different publication,
3
but have been simplified here and made more generalised to cover
both internal and external auditing:
Continuous monitoring-A feedback mechanism, primarily used by management, to
ensure that systems operate and transactions are processed as prescribed. For example,
management might monitor the key control that ensures that customer orders are
checked against credit limits to ensure that it remains in place and is not deactivated.
Continuous auditing-The collection of audit evidence, by an auditor, on systems and
transactions, on a continuous basis through a period. For example, the auditor could
extract details of unusually large adjusting journal entries daily for investigation, validate
the reasons for the journal and whether it has been approved, and document these
findings. The audit 'file' of evidence will be built up from these investigations, as will the
auditor's knowledge of what is happening in the business.
Continuous assurance-Providing a continuous or ondemand assurance opinion on
systems or transactions. A continuous opinion could represent an auditor's opinion that
controls are operating satisfactorily, unless a report is given to the contrary, often
referred to as an 'evergreen' audit report. An on-demand audit opinion could be called
for at any time to give an opinion that is not necessarily coterminous with a fiscal year
or month-end. For example, a potential investor might want to know the state of a
company's affairs on the day that he/she makes a stock purchase decision, not what it
was at some point in the past covered by the last set of published accounts. These types
of opinions are rare, and there has been little demand for them in the past. However, it
is possible that this position may change in the future, and the profession needs to be
ready.
These three elements are each built upon (and depend upon) the one before. Continuous auditing
needs continuous monitoring systems to be in place to be effective. These monitoring systems provide
the evidence to be collected and assessed. Continuous assurance needs continuous auditing to provide
the evidence on which the evergreen or on-demand opinion can be based.