（2006）Continuous monitoring of business process controls：A Pilot Implementation of a Continuous auditing System at Siemens.pdfVIP

International Journal of Accounting Information Systems 7 (2006) 137 – 161 Continuous monitoring of business process controls: A pilot implementation of a continuous auditing ☆ system at Siemens Michael Alles a , Gerard Brennan b , Alexander Kogan a,⁎, Miklos A. Vasarhelyi a a Rutgers University, Rutgers Business School, 180 University Avenue, Newark NJ 07102, United States b Siemens Corporation, United States Received 12 June 2005; received in revised form 15 October 2005; accepted 26 October 2005 Abstract In this paper we report on the approach we have developed and the lessons we have learned in an implementation of the monitoring and control layer for continuous monitoring of business process controls (CMBPC) in the US internal IT audit department of Siemens Corporation. The architecture developed by us implements a completely independent CMBPC system running on top of Siemens’ own enterprise information system which has read-only interaction with the application tier of the enterprise system. Among our key conclusions is that “formalizability” of audit procedures and audit judgment is grossly underestimated. Additionally, while cost savings and expedience force the implementation to closely follow the existing and approved internal audit program, a certain level of reengineering of audit processes is inevitable due to the necessity to separate formalizable and non-formalizable parts of the program. Our study identifies the management of audit alarms and the prevention of the alarm floods as critical tasks in the CMBPC implem