Internal Audit Provides Continuous Assurance with Reliant

IDC OPINION

IDC research shows that close to 70% of organizations hold internal audit responsible for internal controls monitoring and testing. While this initially was a response to the onerous workload put upon internal audit by Sarbanes-Oxley, the role of internal audit is evolving within many organizations as a key stakeholder in governance, risk, and compliance (GRC) strategies. Findings include:

• This evolving role expands the purview of internal audit, in particular moving away from periodic reviews of a sample of transactions to continuous monitoring and assurance across all transactions based upon assessed risk.
• As the requirements of internal audit change, IDC expects that software solutions will evolve to support not only internal audit team processes and documentation but scalable, enterprisewide assurance analytics, monitoring, and testing.
• Internal audit groups should assess current technology solutions that are emerging to help them be successful. Automation is an integral part of next- generation internal audit strategies that will arm teams to meet evolving GRC requirements with measurable benefits in cost, time, and audit fee reduction

IN THIS INSIGHT

This IDC Insight highlights Reliant Solutions' strategy and the related business need for continuous assurance analytics and monitoring that is emerging as a best practice. Reliant Solutions provides continuous audit and risk management software focusing on the needs of the evolving role of internal audit. Reliant has recognized organizational requirements for continuous monitoring of transactions coupled with the expanding requirement for audit executives to provide a risk-based audit approach and methodology.

SITUATION OVERVIEW

The Evolving Role of Internal Audit

Organizations are moving away from the traditional definition of internal audit and are defining the accountability of internal audit teams as a critical component of corporate governance, enterprise risk management, and optimized compliance strategies. Based upon a study performed by the Institute of Internal Auditors, IDC expects that companies with revenue in excess of $1 billion should expect to spend between 0.03% and 0.2% of annual revenue for an effective internal audit function to support Sarbanes-Oxley requirements, with an even higher percentage expected for smaller companies. Many companies have placed internal audit in a critical fulfillment role for financial compliance requirements, resulting in a significant increase in responsibility for monitoring and testing internal controls on a regular basis. More forward-looking firms as well as those that are highly regulated or decentralized are embarking on a more strategic definition of the internal audit function, supported by automated processes and leveraging the use of technology for analysis and exception management.

Evolving guidelines such as Audit Standard No. 5, approved in 2007, advise businesses to adjust their audit approach to a risk-based methodology. Redefining the role of internal audit within the context of companywide GRC strategies is emerging as a best practice. Many organizations that rely on internal audit to document and test internal controls have seen these departments grow significantly, sometimes tripling in size. Internal audit teams now include a strong mix of information technology skills in response to the requirement for auditing enterprise systems, but the sheer volume of transactions and manual processes requires new tools.

As a result, internal audit must leverage the use of technology to optimize their own efforts. In fact, the smaller the audit team, the greater impact software can have in effectiveness. The project management and testing tools of the past do not scratch the surface of requirements to tap into enterprise systems on a routine basis, analyze large volumes of transactions based upon business rules, and put these activities and results in the context of enterprisewide risk and compliance activities.

A Look at Reliant

Reliant Solutions Inc. recently launched a software solution to provide audit executives with continuous monitoring and continuous audit tools that support the evolution of Internal audit from a document-driven to a data-driven function. The ReliantAuditor solution integrates continuous monitoring of internal controls within a risk-based framework, providing an integrated approach to automating audit operations.

While IDC considers ReliantAuditor part of the GRC software solutions market, Reliant has taken a unique approach by developing an application to automate audit operations from the perspective of the chief audit executive. ReliantAuditor combines key capabilities that many times exist in a disconnected and incomplete approach within separate applications as manual process, or may not be happening at all.

IDC defines two subcategories of GRC applications that have evolved over the past several years. In effect, Reliant has brought together capabilities in both areas to arm the audit function:

• Compliance and risk management solutions. These applications support the process automation and documentation requirements of several governance processes, including the assessment and certification of business/internal controls, policy and procedure management, audit management, and enterprise/operational risk, among others.

  ReliantAuditor capabilities in this area include:

  • Audit plan management. Managing the audit plan in an integrated manner to meet internal audit requirements and concurrently mapping these activities to compliance frameworks such as COSO
  • Control testing and assessment. Deploying a risk-based framework for assessing controls and collecting evidence, and automating test plans where applicable
  • Remediation management. Providing closed loop process support and documentation, providing evidence of identification and remediation of control weaknesses and potential risks
• Business assurance analytic applications. These applications support detailed, rule-based analytics to perform proactive analysis to support continuous monitoring at the transactional level to assess controls, support audit requirements, identify fraud, and uncover potential business risk.

  ReliantAuditor capabilities in this area include:

  • Continuous controls monitoring. Transaction-based continuous controls monitoring and test execution
  • Evidence management. Gathering risk- and control-based audit evidence from IT systems effectively and efficiently and with improved quality

The combination of the above capabilities are integrated with ReliantAuditor to support a dynamic risk framework that provides a continuous status of audit results across the enterprise, changing the paradigm of the internal audit function, as shown in Figure 1.