Sunday, August 9, 2009

Anything worth doing is worth doing well - and Often!

I had a discussion today with a panelist who will be speaking about Continuous Auditing / Continuous Controls Monitoring at an IIA Chapter meeting later this month. The panelist's shared services group uses a leading CCM system for one very specific business area - Travel & Entertainment. They have had a very favorable ROI with their use of CCM, and users in Finance, Internal Audit, and elsewhere all appreciate the workflow capabilities of their CCM system. Users and especially management recognize that the workflow capabilities and also frequent extraction capabilities is a quantum leap forward from ERP query tools and data analysis tools like ACL and IDEA. Instead of spending time to extract data and run scripts, the CCM solution automates those steps and allows more time for research and resolving issues.

He asked me what other business processes make good applications for CCM, and I shared that it's a variety of application areas - everything from review of Manual Journal Entries to Accounts Payable Disbursements to Grants and Contracts in Higher Education. Across multiple industries and also across multiple systems.

So whether it's updating an audit plan quarterly instead of annually, or analyzing manual journal entries for fraud or error monthly instead of quarterly. If it's worth doing, ask how you might do it more frequently. With modern CCM tools, you'll find that many important financial control activities can be done well, and Often!.

1 comment:

toomuchcountry said...

When subject of CA/CM comes up, T&E generally travels with it (pardon the pun). Yet I'm puzzled by what is being found by IA. Years ago, travel exp wasn't mgd well & much more subject to abuse. But today, seems more companies use natl travel agreements, automated submission systems, corporate credit cards, and SOD to review/process reimbursements. So I'm curious if excessive or unsupported amounts are the finding? Or are folks getting reprimanded or term'd as a result of the CA/CM process ID'ing process/control override?