（2008）Continuous Monitoring and Auditing：What is the difference？.pdfVIP

Continuous Monitoring and Auditing: What is the difference? By John Verver, ACL Services Ltd. Call them the twin peaks of continuity – “continuous auditing” and “continuous monitoring.” There are certainly similarities between them, but they are not quite the same processes. Both can be cornerstones in helping internal audit respond effectively to the increased expectations that are placed upon them. They can also help organizations operate more efficiently and more profitably. The concept of continuous auditing is fairly straightforward: Audit performs auditing activities on a frequent repeated basis to provide ongoing assurance and more timely insight into risk and control issues. Continuous monitoring is also straightforward: It is essentially a process that falls under management’s responsibility, in which key business process transactions and controls are constantly assessed. This permits ongoing insight into the effectiveness of controls and the integrity of transactions running within them. Are these two separate concepts or merely variations of a theme? There is indeed a primary difference, which is related to ownership of the process. Though both processes are similar and tend to produce similar outcomes, continuous auditing – as its name implies – is owned by the audit function and can include any audit process that is repeated regularly; whereas continuous monitoring is a process owned by management. Management is responsible for maintaining effective controls systems, so it follows that they should have the primary responsibility for monitoring the effectiveness of controls. They also have the most to benefit from obtaining timely insight into transactions that are the result of fraud, error or abuse. The confusion is understandable. The term “continuous auditing” has existed for some 20 years, and has laid a solid basis for familiarity with the “continuous” concept. Audit has regularly seen “cont