ABSTRACT
Recent research has focused heavily on the practicality and feasibility of alternative architectures for supporting continuous auditing. In this paper, we explore the alternative architectures for continuous auditing that have been proposed in both the research and practice environments. We blend a focus on the practical realities of the current technological options and ERP structures with the emerging theory and research on continuous assurance models. The focus is on identifying the strengths and weaknesses of each architectural form as a basis for forming a research agenda that could allow researchers to contribute to the future evolution of both ERP system designs and auditor implementation strategies. There are substantial implications and insights that should be of interest to both researchers and practitioners interested in exploring continuous audit feasibility, capability, and organizational impact.
I. INTRODUCTION
Over the past 20 years, the discourse on the need for, and ability to deliver, continuous auditing of business information has slowly gained momentum. Today, the concepts of continuous auditing have reached the instantiation stage, becoming a key element in many internal audit departments’ risk monitoring strategies. Additionally, continuous auditing is increasingly under consideration as a tool to augment the external audit. This progression has included the evolution of architecturally different methodologies for approaching continuous auditing in computerized environments, primarily embedded audit modules EAM, which are software modules embedded in an information system (i.e., built into) to monitor activities in such systems (Groomer and Murthy 1989), and a monitoring control layer (MCL), which is an external software module that operates independently of the information system to be monitored but is linked into the system and/or its underlying database to provide a similar level of monitoring (Vasarhelyi et al. 2004). A key component of the discourse in recent years has been focused on the advantages, limitations, and feasibility of the two dominant approaches (Alles et al. 2006; Groomer and Murthy 2003; Kogan et al. 1999; Kuhn and Sutton 2006; Vasarhelyi 2006; Vasarhelyi et al. 2004; Woodroof and Searcy 2001).
IV. CONCLUSION
The development and pervasive use of ERP systems provides the critical infrastructure necessary for the effective evolution of the assurance function from a periodic event to an ongoing process through the integration of continuous auditing applications. Two principal system architectures for the development and continuous auditing applications have emerged in research literature. The Embedded Audit Module methodology developed early on in the domain’s existence integrates continuous auditing functionality internally within the system of concern and operates in a truly real-time, continuous mode. Subsequently developed as an alternative to EAM, the Monitoring and Control Layer methodology focuses on an external module that interfaces with the system of concern to retrieve scheduled interfaces of selected data. Each of the continuous auditing approaches offers distinct advantages over the other.
