Introduction

Electronic commerce, electronic data interchange (EDI), and the Internet are dramatically changing business practices and record keeping. Doing business on the World Wide Web enables organizations to connect into the online world and improve all aspects of their business. In this high-technology environment business transactions are conducted entirely in electronic form. Technological advances have taken the form of low-cost, high-speed digital data transmission by utilizing hardware that produces information quickly and easily, and using software that reduces and, in many cases, eliminates much time, space, and other constraints to information. The progress in information technology, while reducing both transaction costs and asymmetric information problems, has increased economies of scale and scope in all business sectors (Albrecht and Sack 2000). The 1998 Vision Project of the American Institute of Certified Public Accountants (AICPA) states that technological advances are significant forces affecting the accounting profession (AICPA 1998a). Traditionally, credible financial reports could only be produced on a periodic basis, primarily because the information needed to generate the reports was too costly to obtain on a real-time basis. Consequently, reports have been issued months after the occurrence of the actual events they represent. In this setting, auditing is mostly a backward-looking exercise testing the accuracy of the reported numbers. Today, organizations can produce standardized financial information on a real-time, online basis. The time is near when companies will allow shareholders and others to have access to real-time corporate financial information. Real-time accounting needs real-time auditing to provide continuous assurance about the quality of the data. Thus, continuous auditing is likely to become commonplace as audit clients increasingly shift to electronic real-time accounting systems. Continuous auditing enables auditors to significantly reduce and perhaps eliminate the time between occurrence of the client’s events and the auditor’s assurance services thereon.

This paper demonstrates an approach to address the unique control and security concerns in database environments by using audit modules embedded into application programs. Embedded audit modules (EAM) are sections of code built into application programs that capture information of audit significance on a continuous basis. The implementation of EAMs is presented using INGRESS a relational database management system. An interface which enables the auditor to access audit-related information stored in the database is also presented. The use of EAMs as an audit tool for compliance and substantive testing is discussed. Advantages and disadvantages of employing EAMs in database environments and future directions in this line of research are discussed.

ADVANCES in computer technology over the past several years have made computer-based accounting systems increasingly complex. With the virtual elimination of the traditional audit trail in computerized systems [Weber, 1982), internal control and system security are critical concerns. With recent improvements in computer technology and reductions in hardware costs, database management systems [DBMS] have become commonly used for business data processing. While there are unique control and security concerns relative to DBMS applications [Fernandez et al., 1981, p. 151), there is some evidence that auditors do not sufficiently adjust their audit procedures in the environment of DBMS [Roberts, 1980]. A variety of computer audit techniques have been discussed in the literature [Cash et al., 1977]. Though auditors have developed generalized audit software [GAS] to obtain audit evidence in advanced computer systems, such software packages are generally incompatible with the complex file structures of database systems [Cash et al., 1977, p. 824; Fernandez et al., 1981, p. 164]. Access to client database systems using GAS is most often done through intermediate sequential files extracted from the database. Embedded audit modules [EAM] are an example of concurrent auditing techniques [CAT] which continuously monitor transaction processing. Weber [1982, p. 475] highlights the increased need for CATs in the environment of database systems due to the integration of sub-systems and the sharing of data. Further, EAMs are perceived by auditors to be very efficient methods of auditing advanced computer-based systems [Tobison & Davis, 1981; Garsombke & Tabor, 1986]. The purpose of this paper is to describe an approach to the continuous auditing of database-driven accounting applications using EAMs. The objectives of this paper are to discuss (1) a selected number of unique control and security issues related to DBMS-driven accounting systems, (2) the use of a relational DBMS to construct and implement EAMs in a sales application, and (3) the utilization of EAMs as an audit tool. The significance of this paper lies in the demonstration of how audit modules embedded in a DBMS-driven application can address the unique control and security aspects of database environments. In addition, we demonstrate how the DBMS might enable the auditor to access audit-related information collected by the EAMs. In this manner, the illustration presented in this paper would assist auditors contemplating the use of EAMs in DBMS environments.

I. INTRODUCTION

Organizations have been subjected to a strong pressure to audit both their financial business processes and other processes of great relevance in the various dimensions associated with organizational performance. In this context, Continuous Auditing appears as an effective tool to provide, in run-time, credibility and reliability to the organizational processes. Continuous Assurance is another concept that emerged as a poweful tool which, using technology, provides compliance of the organizational processes simultaneously with, or shortly after, the occurrence of events of the process under evaluation [1]. However, despite the numerous advantages associated with the implementation of continuous assurance solutions [2, 3], there are few successful implementation cases documented, mostly in recent years, and thus we can say that Continuous Assurance is developing at a very slow pace [4-6]. In Figure 1 we can observe that Continuous Auditing is a crucial element of Continuous Assurance. Continuous Auditing refers to the activities carried out that give credibility to the operations, in addition to allowing more timely control and risk management. Continuous Monitoring (CM) is another element responsible for constantly monitoring and evaluating transactions and their controls, allowing a real-time view of the effectiveness of controls and the integrity of transactions [7]. Figure 1. Continuous Assurance (adapted from [8]) Moreover, we may observe that the audit activities assess whether the management activities are appropriate and effective so that organizations can have a greater degree of certainty regarding the effective operation of controls, risk management and integrity of systems, and the information for decision making [8-10]. Given the advantages that organizations can obtain from the implementation of Continuous Assurance, a faster evolution of research on this topic would be expected. Therefore, as a starting point to understand this slow evolution, we intend to analyze the research evolution of one of its most important component: Continuous Auditing. This paper consists of this introductory section, which presents the motivation of this work; a section that briefly presents the concept of Continuous Auditing; a section that describes the methodology and methods used to conduct the study; a section that analyzes the results of the study; and a final section with some considerations.

Introduction

Auditing is currently at a critical juncture. Specifically, advances in information technology in conjunction with real-time approaches to conducting business are challenging the auditing profession. As such, the primary purpose of this essay is to examine the extent to which the auditing discipline in the United States has advanced and identify the trajectory it might take if it is to continue to thrive and provide long-run value to society at large.

A Brief History of Auditing in the United States

Although auditing procedures have been relied upon for many years, the formal practice of auditing has been in existence for a relatively short period. In addition, emphasis has historically been placed on a periodic, backward-looking approach whereby key events and activities are often identified long after their occurrence or simply undetected. Given that recent developments and technologies facilitated a movement away from the historical paradigm and toward a more proactive approach, it is essential that auditors understand what the future audit entails and how they might begin to envision a logical progression to such a state. To enhance this comprehension, it is advisable to consider how auditing has evolved from its formal beginnings in the early twentieth century.  The Industrial Revolution and the resulting explosion in growth of business activity led to widespread adoption of auditing methods. The railroads, in their efforts to report and control costs, production, and operating ratios, were major catalysts in the development of the accounting profession within the United States (Chandler 1977). Specifically, firms became aware of the need for mechanisms of fraud detection and financial accountability, and investors increasingly relied upon financial reports as corporations began to participate in the stock market. Although these issues prompted an expansion in the use of accounting and auditing mechanisms, it was after the stock market crash of 1929 that auditing became an obligatory process in the United States.

1. Introduction

The objective of financial reporting is to provide information that is useful to management and stakeholders for resource allocation decisions (FASB, 2006). For financial information to be useful, it should be timely and free from material errors, omissions, and fraud. In the real time economy (Economist, 2002; Vasarhelyi et al., 2010), timely and reliable financial information is critical for day to day business decisions regarding strategic planning, raising capital, credit decisions, and supplier or vendor partnerships. Advances in accounting information systems such as the advent of enterprise resource planning (ERP) systems have enabled the generation of real time financial information. However, the practice of traditional auditing has not kept pace with the real time economy, and the state of the art of assurance has lagged. The lack of support for real time assurance may be primarily attributed to the manual nature of traditional audit procedures. Manual audit procedures are labor and time intensive. These constraints limit audit frequency to an annual occurrence. As a result, management and stakeholder reliance on real time financial information can lead to adverse resource allocation decisions. These time and effort constraints can be alleviated through the use of technology and automation. Reliance on technology throughout the audit process can reduce labor intensiveness (Elliott, 1998) and increase production efficiencies (Menon and Williams, 2001). Innovation of the traditional audit process using an automation technology such as continuous auditing (CA) will be an essential step toward the development of real time assurance. OECD (1997) defines a technological process innovation as the implementation of new or significantly improved production or delivery methods of goods or services. In the case of continuous auditing, the methodologies enhance the delivery of auditing services by making the audit process more efficient and effective through the use of technology and automation. The increased efficiency and effectiveness of the audit process enables more frequent or real time audits and hence enhances the reliability of real time financial information