Journal of Economics, Business, and Accountancy Ventura Vol. 17, No. 1, April 2014, pages 127 – 144

Continuous auditing: Developing automated systems for fraud and error detections

Gregorius Rudy Antonio1

1 Surabaya University, Kalirungkut Street, Surabaya, 60293, East Java, Indonesia

ARTICLE INFO ABSTRACT Article history: Indonesian Institute of Certified Public , American Institute of Certified Received 13 February 2014 Public Accountants and the Canadian Institute of Chartered Accountants(SAS 99 sec Revised 8 April 2014 110, par 2) establishes auditors’ responsibility to plan and perform the audit to obtain Accepted 16 April 2014 reasonable assurance about whether the financial statements are free of material mis- statement, whether caused by error or fraud to plan and perform to provide a JEL Classification: reasonable assurance that the audited financial statements are free of material fraud. M42 This study proposed the development of Automated Audit System model to assist auditors in bridging them to the challenges in detecting fraud. This approach firstly Key words: provides a framework to have better understanding about the business process and Continuous Auditing, data structures of information systems which is required in establishing an effective Benford’s Law, audit program. These ingredients are mapped in the audit process, including audit Audit Systems, objectives, internal control and audit rules by using the Use-Case Diagram, Data Fraud. Flow Diagram and Entity Relationship Diagram. Second, this study employs Ben- ford’s Law and Automatic Transaction Verification for the detection of anomalies and DOI: irregularities to design the framework. It also presents a systematic case study of ac- 10.14414/jebav.14.170112 tual continuous auditing in department stores that using ERP systems. It is expected to detect frauds and errors. It proves that Continuous Audit and Benford Law can establish strong framework in Automated Audit Systems for Fraud Detections and finally provide a big contribution to internal control and company policies.

ABSTRAK Indonesian Institute of Certified Public Accountants, American Institute of Certified Public Accountants and the Canadian Institute of Chartered Accountants(SAS 99 sec 110, par 2) menetapkan tanggung jawab auditor, yaitu merencanakan dan melaksana- kan audit untuk meyakinkan bahwa laporan keuangan bebas dari salah saji materi, yang disebabkan oleh kekeliruan maupun kecurangan dalam merencanakan dan me- laksanakan audit yang bebas dari kecurangan. Penelitian ini mengusulkan pengem- bangan model Automated Audit System untuk auditor dalam mengatasi kecurangan. Pertama, pendekatan ini menyediakan kerangka kerja untuk memiliki pemahaman yang lebih baik tentang proses bisnis dan struktur data sistem informasi yang dibu- tuhkan dalam membangun sebuah program audit yang efektif. Semua aspek ini dipetakan dalam proses audit, termasuk tujuan audit, pengendalian internal, dan aturan pemeriksaan dengan menggunakan Use-Case Diagram, Data Flow Diagram, dan Entity Relationship Diagram. Kedua, penelitian ini menggunakan Benford’s Law and Automatic Transaction Verification untuk mendeteksi anomali dan penyimpan- gan untuk rancangannya. Di sini juga disajikan sebuah studi kasus yang sistematis dari audit kontinu di department store yang menggunakan sistem ERP. Ini diharap- kan dapat mendeteksi penipuan dan kesalahan. Ini membuktikan bahwa Continuous Audit and Benford Law dapat membangun kerangka yang kuat dalam Automated Audit Systems untuk deteksi kecurangan dan akhirnya memberikan kontribusi yang besar terhadap pengendalian internal dan kebijakan perusahaan.

* Corresponding author, email address: 1 [email protected]

127 Gregorius Rudy Antonio: Continuous auditing: …

1. INTRODUCTION This study focuses on the development of a Traditional audit has been obsolete so that there are model of Automated Audit System that can bridge three facts that show or at least support it. First, the above challenges to be faced by auditors in de- that we have entered the era of technology where tecting fraud and errors. So the research question every aspect of life has been dominated by technol- can be described as follows: 1. How to establish a ogy and even harder to find the aspects of life that conceptual model to bridge the semantic gap, do not have the technology. Business has also ex- which occurs between the auditors to audit the perienced a fundamental transformation into the environment to form an audit rule? How to build a digital age (Majdalawieh & Zaghloul 2008, Vasar- model of Automated Audit System that can answer helyi & Greenstein 2003). Second, now, almost all today are challenges in detecting fraud? the transactions handled by the technology and The study tries to improve the effectiveness even most transactions done automatically without and efficiency of the audit. Through the Continu- involving humans as well as the data storage and ous Auditing, audit can be performed not only par- documents themselves have been made in elec- tial and real-time but with limited resources, also so tronic forms (Rezaee et al. 2000, Zhao and Yen that audit quality can be achieved. It also improves 2004). The third, the Enterprise Resource Planning the quality of audit in producing financial state- (ERP) has been widely used (Prouty 2011) so the ments that are free from material misstatement and activity, and the data become large and complex as fraud. This study is limited to the data or pattern well as scattered everywhere. All these facts give that has been known by the auditor in detecting hard pressure on the traditional audit existence that anomalies and or fraud. Yet, an unknown pattern relied solely on manual. that has never happened or that has not been Fraud trend analysis conducted by the UK’s mapped will not be detected. Therefore, research Fraud Prevention Service from 2007 to 2011, shows on Fuzzy Logic that enables the system to detect a a significant increase in amount of 27.84 % (CIFAS new pattern that has not been found or mapped 2011). Surely, this will give greater emphasis to the will be very useful further research. auditors. Enron, WorldCom, and other scandals make regulators parties find a way to suppress 2. THEORETICAL FRAMEWORK AND HY- fraud. AICPA in SAS 99 (2002), the Indonesian In- POTHESIS stitute of Certified Public Accountants (2011) in Continuous Auditing Auditing Standards Section 110 emphasizes the In Indonesian Institute of Certified Public Account- need for responsibility of auditors in minimizing ants, the Canadian Institute of Chartered Account- fraud. Aware of the limitations of traditional audit ants (CICA) and the American Institute of Char- in dealing with such pressures, then the Panel on tered Accountants (AICPA), Continuous Auditing, Audit Effectiveness (2000, p.172) points out: it is stated that “a methodology that enables inde- “The challenge for the auditing profession will pendent auditors to provide written assurance on a be to develop new approaches to auditing to subject matter using a series of auditors’ reports meet the demands for any new information issued simultaneously with, or a short period of and to adapt to changes in the time after, the occurrence of events underlying the model. These new approaches may include subject matter” (CICA, 1999). some form of continuous auditing and require Kogan et al. (2010) argue that first research on new tools and skills, with greater emphasis on Continuous Auditing was from Groomet and the use of technology-driven analytical and di- Murthy (1989), Vasarhelyi, and Halper (1991). They agnostic procedures” are trying to build Continuous Auditing architec- The need of high-quality audits, coupled with ture with a modern approach by incorporating em- an increasingly large electronic all data which can bedded audit modules as well as control and su- be geographically dispersed and does not have the pervision layers. The research on Continuous Au- audit trails, followed by increasing fraud makes the diting research have grown rapidly both from a traditional audit hard to achieve audit quality de- technical aspects (Pathak 2005, Orman 2001, Kogan sired. The limited resources of human and funds et al. 1999, Woodroof & Searcy 2001, Rezaee et al. make conventional methods are not able to provide 2002, Murthy 2004, Murthy and Groomer 2004), answers to the audit requirements of the Real Time, and economic aspect, and have a big impact on the Scope and Lack of Resources in detecting fraud and world of practical auditing (Alles et al. (2002), errors (Vasarhelyi & Greenstein (2003), Rezaee et al. Kneer (2003), Elliott (2002), Vasarhelyi (2002), (2000)). Searcy et al. (2004)).

128 Journal of Economics, Business, and Accountancy Ventura Vol. 17, No. 1, April 2014, pages 127 – 144

Figure 1 Systematic Continuous Auditing Procedures

Source: Li et al. (2007), p.5.

Table 1 Management Assertions for Each Category of Assertions (Arens et al. (2012)) Assertions About Classes of Assertions About Assertions About Transactions and Events Account Balances Presentation and Disclosure Occurrence Existence Occurrence and rights and obligations Completeness Completeness Completeness Accuracy Valuation and allocation Accuracy and valuation Classification Classification and understandability Cutoff Rights and obligations

It can be concluded that the Continuous Audit- business processes to the data through the Data ing definitely always improves itself through tech- Flow Diagram (DFD). Lastly, the DFD will identify nology enhancement and adjustments to the needs data model and establish the rules-related audit of auditors in achieving audit objectives. This study through Entity Relationship Diagram (ERD). Last focuses on the technical aspects of building a of all these rules will be compared with the operat- framework in Continuous Auditing; while other ing system and software that are used in order to aspects of it can be investigated in future research. establish an audit module. In addition, audit mod- ules that will assist auditors in monitoring critical Design of Continuous Auditing processes and create audit reports. This systematic Arens et al. (2012) proposed a gradually step in the procedure can be drawn as shown in Figure 1. implementation of Continuous Auditing wherein In achieving audit adequacy, the auditor must test of controls and substantive test build as an in- understand about assertions (Arens et al. (2012)). tegral part in the system. Systematic procedures International Auditing Standards (IAS) and U.S. required to produce an optimal Continuous Audit- Auditing Standards (GAAS) divide assertion into ing. Designing Continuous Auditing starts from three categories: (1) Assertions about classes of establishing audit program, business processes to transactions and events on the audited period, (2) be audited, the audit objectives, the key controls for assertions about the ending balance at the end of each audit objective and necessary audit rules. The the period, (3) Assertions about presentation and audit program was established with the help of disclosure. Basically, this assertion can be classified systems analysts and conceptual models in concep- as shown in Table 1. tual models, the auditor can use the Use-Case Dia- Having identified the relevant assertions, the gram to understand business processes and map auditor can develop audit objectives of each cate- out an audit plan into key business processes care- gory of assertions. The purpose of the audit is al- fully and completely (Li et al. (2007), Olsen (2012)). ways followed and closely related to the assertion. Use-Case Diagram (UCD) is used to map key The reason why the auditor used the purpose of

129 Gregorius Rudy Antonio: Continuous auditing: …

Figure 2 Model of Continuous Auditing for Fraud and Error Detection

auditing not the assertion is to provide a frame- The Use of Benford's Law to Detect Fraud work for auditors to be able to collect sufficient SAS No. 99 has set the accounting profession to relevant evidence and decide the proper evidence. seek analytical tools and methods for detecting the This study will be identifying the rules, busi- fraud audit. In particular, SAS No. 99 (paragraph ness processes, information systems and the struc- 28) reaffirmed for SAS 56 requires auditors to use ture as well as the flow of data by mapping to get a analytical procedures at the planning stage of the complete and comprehensive picture. This study audit in order to identify the existence of, and the will also build a conceptual model to bridge the transactions or unusual events (AICPA 2002). semantic gap so that it can be established required Benford's law has been shown to be effective as audit program that will eventually build the audit analytical procedures in detecting fraud and errors rules. (Durtschi et al. 2004, Albertch 2010, Diekmann and Jann 2010, Nigrini 2000). Benford's Law (Benford Fraud 1938) is a law that indicates a pattern of frequency SAS 99 and Indonesian public profes- of occurrence of a digit. If the numbers are not ma- sional standards 316 defines fraud as an intentional nipulated, the frequency of occurrence of the ex- act that results in a material misstatement in the pected frequency would like Benford's law itself. financial statements that is the subject of the audit. Thus, the Benford’s law can be used as an ana- There are two types of misstatements that the audi- lytical tool to detect anomalies which when investi- tor may consider as fraud, first, misstatements aris- gated further anomalies will detect fraud. Benford’s ing from fraudulent financial reporting and misap- law will support effective audit quality and effi- propriation of . Second, misstatements result- cient in finding fraud as it can meet standardized ing from fraudulent financial reporting that can be by SAS 107, AU Sec 312 regarding risk analysis, either intentional misstatement or omission of a SAS 111, AU Sec 350 of the sampling approach and number or disclosures in financial statements de- SAS 99, AU Sec 316 regarding the requirements of signed to deceive users where fraud (Overhoff,2011). This study will examine the effect causes the financial statements are not whether there are anomalies in the data to be com- presented in accordance with generally accepted pared with the definition of fraud as has been clari- accounting principles. fied in the previous step. However misstatements arising from misap- propriation of assets involve the theft of assets of an Models of Automated Continuous Transaction entity in which the impact of the theft causes the Verification Environment (ACTVE) financial statements are not presented, in all mate- This model facilitates the examination of transac- rial respects, in accordance with GAAP. This study tions efficiently and in real time. This model sig- will clarify whether an anomaly is included in the nificantly reduces examination time, especially at category of fraud or not in accordance with the the time of data integrity checking (Spelt & Blasters applicable rules. 1997) and provides real-time confirmation of the

130 Journal of Economics, Business, and Accountancy Ventura Vol. 17, No. 1, April 2014, pages 127 – 144 items identified by the auditor to examine the nomena in the data. transaction and how to access both within the or- Based on such inspection, pattern matching ganization and outside with entities outside the can be used to investigate a particular phenomenon organization (Dull et al. 2006). in the very complex case (McDonough and Basically, this model will provide two advan- McDonough, (1997), Krathwohl (1993)). Although tages: first, it is to improve the timeliness and the document analysis and observation are the breadth of information that is audited and the sec- main source of information, this study also col- ond is the accuracy of the identification of issues that lected information from interviews, document need to be audited. Implementation ACTVE on Con- analysis from business process mapping, Standard tinuous Auditing is based on the identification of Operating Procedure (SOP), internal control, busi- business rules and policies in the transaction integ- ness rules, audit rules, a document that is used to rity inspection and validity of data and transactions. structure the data. Every transaction that is input or there will be Observations made on the overall activity of checked against the rules and policies, including the company begin taking delivery of materials to the audit rules that apply when there is a violation production to finished goods warehouse. Observa- and will be marked as an exception. Any exception tions were also carried out to check whether docu- will trigger the alarm system Continuous Auditing, mentation has been compiled in accordance with which will result in a report to the appropriate au- that occur in the field and to gather information thorities. This study will examine whether there is that cannot be documented as informal informa- an anomaly in the transaction or process to be tion, which is common. Interviews were conducted compared with the definition of fraud as has been with a semi-structured approach begins with a se- clarified in the previous step. ries of questions and expanded as needed. This study will examine the data by extracting data from Continuous Auditing for Fraud Detection the database and mapping to existing data tables. Continuous Auditing models must be able to per- Chen and Leitch (1998) propose to use the Entity form optimal detection to meet the real-time and Relationship Diagram and Computer-Aided Soft- efficient criteria. Data detection can be provided by ware Engineering (CASE) as auditor facility in re- Automatic Data Monitoring and Analytical as well viewing this case. as Benford’s law, while transaction detection can be performed ACTVE so Continuous Auditing is to be Source of Data formed as in Figure 2. This study was conducted at Department Store KKK. A department store has been chosen because de- RESEARCH METHOD partment stores grow so rapidly in Asia (Nielsen This study uses a case study either descriptive or (2010)). Another reason, this company has con- explanatory. The descriptive method explains the straints in human resource and that make the condition of the company in relation to establish a audit becoming difficult as well as having a great Continuous Auditing model, including the level of risk (Protivity, (2006)) and susceptible to fraud technology, databases and information systems. (Deloitte 2008, Shih et al. (2011), Daily (2012), Kroll, Explanatory method used to describe how the (2012)). A department store has been established components of company like rules, company poli- since 1978, and employed 240 employees. The De- cies, and audit rules relating to Analytical Monitor- partment Store has the following specifications: ing, Benford’s Law and Automatic Transaction 1. The building area of about 9,000 m2 Verification intertwined in searching for the opti- 2. Employees are divided into two shifts mization of fraud detection. 3. Department (divided by-product class) 127 unit Yin (2009) identified a case study is an empiri- 4. Having 21 Cashiers cal inquiry to investigate the facts in the context, 5. Data processing has been using the integrated especially when the boundaries between fact and software with the Microsoft SQL Server data- context are not clearly visible. Then, it is stated that base. the unique strength of the case study is its ability to 6. The sales data in 2011 around Rp. handle a variety of evidence (documents, question- 292.000.000.000, 1.962.789 invoice with detailed naire, interview and observation) so that it can be transaction records of 3.927.121 records done construct development. Explanatory case studies examine the data in detail and tightly at 7. Data purchases in 2011 was as much as 10.879 both the surface and deep level to explain the phe- invoice with transaction detail records: 125.283 records

131 Gregorius Rudy Antonio: Continuous auditing: …

Figure 3 Use Case Diagram

uc Actors

Sales Check Items «include»

Cashier «include»

«include» Scan Items «include» Generates «include» Sales Reports «include» Calculate Total and Tax

Updates Inv entory By Payment Sales Promotion Girl «include» Customer

Checks By Credit Card Inv entory

«include»By Debit Card

Sales Superv isor

Order/Reorder Generates Payment Inv entory Reports

Purchasing Manager

Generates Receiving Receiving Inv entory Reports «include»

Warehouse Man «include» Generates Account Generates Account Payable «include» Payable-Consignment

«include»

Account Payable-Payments

Finance Manager Supplier

4. DATA ANALYSIS AND DISCUSSION make sales and do the acceptance of money from Business Process customers. Acceptance of this money will be in In performing an audit, auditor must understand cash, debit card or credit card. Sales inputted by the business processes in order to create an effec- cashier will update the inventory file and sales file. tive audit program. The auditor should also exam- The inventory file will be monitored by the Sales ine the rules, policies and the environment. In gen- Promotion Girl of each department to determine eral, the systems analyst will use a use case model, the order to the supplier. to perform requirements analysis, process models Before the order to the supplier, orders must be to map business processes and data models to map authorized by the Supervisor and the Purchase. database (Li et al. (2007)). When a supplier sent the goods, warehouse will receive them and at this point the inventory file will Use Case be updated. Account Payable file will be updated Use Case for Department Store-KKK can be de- when the item sold because the entire sale is con- scribed as in Figure 3. Basically, the cashier will signment.

132 Journal of Economics, Business, and Accountancy Ventura Vol. 17, No. 1, April 2014, pages 127 – 144

Figure 4 Figure 5 DFD-Purchase DFD-Sales

Data Flow Diagram ess in the DFD reflects the activity that has a risk Use Case Model Diagram illustrates how a system and required necessary control and audit objects to interacts and how the system responds so this secure it. model is treated as a "Black Box" (Li et al. (2007)). And To be able to explain in detail to establish an Audit Program and Audit Findings-Purchase audit program, Data Flow Diagram is the right tool In DFD-Purchase, there are four main processes: (1) to use (Whitten (2005)). Use Case diagram above prepare the purchasing plan, (2) place the Purchase (Figure 3) can basically be divided into two proc- Order (PO), (3) Receive Inventory, (4) Pay Vendor esses: (1) the purchase process and, (2) sales proc- (see Table 2 – 5 in Appendices). Therefore, the audit ess. So from this use case can be drawn two DFD. program will be adjusted to the process, and con- DFD-Purchase can be seen in Figure 4 and DFD- tinuous auditing can be performed. Findings of Sales can be seen in Figure 5. continuous auditing will be compared to the tradi- tional audit findings so can determine the effective Entity Relationship Diagram (ERD) and efficient of continuous auditing. To be able to perform effectively continuous audit, the auditor needs to perform the mapping of the Audit Program and Audit Findings-Sales database and the most effective methods used In DFD-Sales, there are four main processes: (1) (Whitten, 2005) is the Entity Relationship Diagram. create invoice, (2) apply payment, (3) collection of Entity Relationship Diagram gives a clear picture of sales, and (4) correction of sales receipt per Cashier the fields contained in the table contained in the (see Table 6 – 9 in Appendices). So the audit pro- database at the same time the relation. By looking gram will be adjusted to the process, and continu- at the field and the relationship of an auditor is able ous auditing can be performed. Findings of con- to make an effective audit program. ERD's depart- tinuous auditing will be compared to the tradi- ment store purchase system it can be seen in Figure tional audit findings so can determine the effective 6 and ERD sale it can be seen in Figure 7. and efficient of continuous auditing. Implementation of continuous audit increases Audit Program the effectiveness and efficiency of audit. That in- From the DFD, ERD and the audit assertion can be crease 8.222 findings that cannot be found by tradi- established an effective audit program. Each proc- tional audit or there is an increase of 249% in find-

133 Gregorius Rudy Antonio: Continuous auditing: …

Figure 6 Figure 7 ERD Purchase Sales ERD

ings. The largest increase findings occurred in the higher so happened to nine digits. Check 2 digits of create invoice, 2.392 findings. After thorough inves- Benford is shown in figure 9 shows where the area is tigation, the cause of the large difference is mainly more abnormalities. And investigations on the above due to the number of COGS is zero or null caused data indicate an error in the preparation department by calculation or weakness of the software used as of 35, 12, 74, 14, 6 and 89. These errors are all mistake well as negligence of employees. While the largest in inputting the price due to human error and lack of increase in percentage occurred in the process of clarity in current prices. This error occurs in five prepare purchasing plan, 1334% due to the late of suppliers are: K0060, V0014, D0034, D006, D0065. making purchasing plan. After doing the investiga- tion, it is known to cause of the delay is employee's Benford’s Law – Vendor Payment indiscipline. Putting Benford’s Law to vendor payment on the Traditional audit never touches the user au- digits 1 shows the results as in Figure 10. Examina- thorization of transactions (Table 10) although this tion of the data shows normalcy. And it is consistent will put the company to the high risk. From the with the results of Continuous Audit findings that investigation founded that the main problems in show at least the vendor payment process. It is as authorization caused by the weakness of the soft- mentioned above due to that supplier payment ware used that allow delete the user even still has process is implemented and controlled by the owner. the transactions. Benford’s Law – Sales Benford Law Putting Benford’s Law on the sales data of digits 1 Benford’s Law - Purchasing and digits 2 shows the results as in figure 11 and Putting Benford Law to purchase on the digits 1 figure12. The examination was conducted at the shows the results as in Figure 8. Examination numbers that are not normal and investigation showed normality except the digit 2 is slightly shows that most errors occur in department 35 and

134 Journal of Economics, Business, and Accountancy Ventura Vol. 17, No. 1, April 2014, pages 127 – 144

Table 10 Summary of Authorization Violation Findings (records) Difference No. Process CA MA (records) 1 Prepare Purchasing Plan(table 1) 124 0 124 2 Place Purchasing Order(table 2) 3 0 3 3 Receive Inventory(table 3) 5 0 5 4 Pay Vendor(table 4) 0 0 0 Total Findings - Purchase 132 0 132 5 Create Invoice(table 5) 543 0 543 6 Apply Payments(table 6) 0 0 0 7 Collection of Payments & Correction of Collection of Payment 274 0 274 per Cashier(table 7) Total Findings - Sales 817 0 817 Total Findings 949 0 949

Figure 8 Figure 9 Benford Law 1 digit – Purchase Benford Law 2 digit – Purchase

Figure 10 Benford Law 1 digit – Vendor Payment

the error is caused by inputting the incorrect selling Data analysis can be described as the Venn diagram price of the 14 inventories. as in Figure 13. Comparing CA and Benford analysis needed to Continuous Auditing and Benford Analysis find the same findings found by both methods, 469 The results of the Continuous Audit and Analysis findings. So CA itself can find 11.048 and Benford’s Benford coupled to see if there are similar findings. analysis contributes 834 findings that cannot be

135 Gregorius Rudy Antonio: Continuous auditing: …

Figure 11 Figure 12 Benford Law 1 digit – Sales Benford Law 1 digit – Sale

Figure 13 Venn diagram: Continuous Auditing and Benford Analysis

11.048

examined by continuous auditing. The investiga- a right tool to map the business processes within a tion explains that the findings nominated by errors unit. It can describe the processes more detail as well from human errors in inputting the data. So that as the relationships among the elements in a business. coupled the continuous auditing and Benford’s By using the use case, the DFD can be established so analysis will strengthen the framework of audit in the data flow from one element to another can be achieving the quality of audit in fulfill the real time, identified deeply. Continuous Auditing will be re- scope and resource constraint. lated to the database then ERD can be a best tool to map the data structure. With mapping throughout the 5. CONCLUSION, IMPLICATION, SUGGES- business, audit program, which is the machine of TION AND LIMITATIONS continuous auditing, will be identified, and continu- Traditional Audit has faced enormous challenges ous auditing framework can be optimized. when dealing with technology. In that case, com- With the implementation of Continuous Audit, munication speed, the amount of data, electronic it can contribute 11.517 findings comprising 4.650 storage media, as well as the complexity of the findings on the process of buying and 6.887 find- business activity lead the conventional audit not ings in selling process. Continuous Audit gives easily to achieve the desired quality of the audit. additional findings that cannot be found by the Further, it is exacerbated by the demands of real- team using traditional audit is equal time, broad scope and limited resources lead to a to 8.222 findings, and these findings are very sig- traditional audit judged to be obsolete. Continuous nificant. Even the user authorization process, which auditing try to assist auditors in facing the above is not audited by the internal audit team, Continu- challenges, especially in finding errors and fraud. ous Audit, donated 949 findings, where this contri- The design of continuous auditing begins with bution is very important contribution since this risk mapping business processes. The use case diagram is is categorized to extremely highly risk for the com-

136 Journal of Economics, Business, and Accountancy Ventura Vol. 17, No. 1, April 2014, pages 127 – 144 pany. This proves CA will make an audit more CIFAS, 2012, 2011 Fraud Trends: Fraud Levels efficient and more effective. Surge Upwards, viewed 28 April 2012, Application of Benford analysis has made an http://www.cifas.org.uk/annualfraudtrends- audit more effective. This is proven by the discov- jantwelve. ery of 834 findings that cannot be pointed out with Dailly, Richard 2012, ‘Fraud in India Manufactur- Continuous Audit and shows 469. It was found also ing and Engineering sector’, Global Fraud Report that support or strengthen the findings of the con- 2011-2012. tinuous audit. This proves strongly that coupled Dalal, C 1999, ‘Using an Expert System In An Au- continuous audit with Benford analysis will make dit: A Case Study of Fraud Detection’, IT Au- an audit more efficient and more effective. dit, pp. 2. Further research can be done by applying Deloitte 2008, ‘Ten Things About Financial State- Fuzzy Logic in Continuous Auditing so fraud pat- ment Fraud: A Review Of SEC Enforcement terns and anomalies that are not defined or identi- Releases, Deloitte Forensic Center. fied by the auditor will be able to be detected. Thus, Dull, Richard B, David P, Tegarden & Lydia LF it will provide protection and detection more accu- Schleifer 2006, ‘ACTVE: A Proposal for an rate for the auditor. Automated Continuous Transaction Verifica- tion Environment’, Journal of Emerging Tech- REFERENCES nologies in Accounting, pp. 81-96. Albrecht Conan C 2010, ‘Fraud and Forensic Ac- Durtschi Cindy, Hillison William & Pacini Carl 2004, counting In a Digital Environment, White Pa- ‘The Effective Use of Benford’s Law to Assist in per for The Institute for Fraud Prevention’, Detecting Fraud in Accounting Data’, Journal of viewed May 5, 2012. Flowerday S, Blundell, A & Solms R Von 2006, ‘Con- Alles MG, Kogan A, Vasarhelyi, & Wu, J 2006, tinuous Auditing Technologies And Models: A ‘Continuous data level auditing: business Discussion, Computers & Security’, pp. 325-331. process based analytic procedures in an un- Gogi Overhoff 2011, ‘The Impact And Reality Of constrained data environment, Working Pa- Fraud Auditing Benford’s Law: Why And How pers, Rutgers Business School. To Use It’, 22nd Annual ACFE Fraud Conference Alles, MG, Kogan, A and Vasarhelyi, 2008, ‘Putting and Exhibition, ACFE. continuous auditing theory into practice: les- Groomer SM & Murthy US 1989, ‘Continuous Au- sons from two pilot implementations’, Journal of diting Of Database Applications: An Embed- Information Systems, Vol. 22 No. 2, pp. 195-214. ded Audit Module Approach’, Journal of Infor- American Institute of Certified Public Accountants mation Systems, pp. 53-69. 2002, Statement on Auditing Standards no. 99: Institut Akuntan Publik Indonesia 2011, Tanggung Consideration of fraud in a financial statement jawab dan fungsi auditor indenpenden, Stan- audit, AU Section 316, New York, pp. 168. dar Pedoman Akuntan Publik, Standar Audit- Andreas Diekmann and Ben Jann 2010, ‘Benford’s ing Seksi 110. Law and Fraud Detection: Facts and Legends’, Kneer Dan C 2003, ‘Continuous Assurance: We are German Economic Review 11(3): pp. 397–401. Way Overdue’,Information System Control Jour- Arens, Alvin A, Elder, Randal J, Beasley Mark 2012, nal, 2003. Auditing and Assurance Services, 14/E, Pren- Kogan Alexander, Vasarhelyi Miklos.G, & Wu, Jia, tice Hall. 2010, ‘Analytical Procedures for Continuous Belkauoi A Riahi & Picur RD 2000, ’Understanding Data Level Auditing: Continuity Equations’, Fraud In The Accounting Environment’, Mana- Working Papers, Rutgers Business School. gerial Finance, Vol. 26 Iss: 11 pp. 33 – 41. Krathwohl 1993, ’Methods Of Educational And Benford, F 1938, ‘The Law Of Anomalous Num- Social Research: An Integrated Approach’, bers’, Proceedings Of The American Philosophical New York, Longman. Society, vol. 78, pp. 551-572. Kroll 2012, Kroll Global Fraud Report 2011 2012, Carslaw, C 1988, ‘Anomalies In Income Numbers: viewed April 25, 2012 http://is2.lse.ac.uk/ Evidence Of Goal Oriented Behavior’, The Ac- asp/aspecis/20080120.pdf. counting Review, Vol. 63, No. 2, pp. 321-327. Kuhn Randel J & Sutton Steve G 2006, ‘Learning CICA/AICPA 1999, ‘Continuous auditing’, Re- From Worldcom: Implications For Fraud Detec- search Report, Toronto, Canada: The Canadian tion Through Continuous Assurance’, Journal of Institute of Chartered Accountants. Emerging Technologies in Accounting, 3, pp. 61-80.

137 Gregorius Rudy Antonio: Continuous auditing: …

Kuhn Randel J & Sutton Steve G 2010, ‘Continu- Prouty, Kevin, 2011, ERP in Manufacturing 2011: ous Auditing In ERP System Environments: Defining the ERP strategy, Aberdeen Group. The Current State and Future Directions’, Rezaee, Z, Ford W & Elam R 2000, ‘Real-time ac- Journal of Information Systems, Vol. 24 No. 1, counting systems’, Internal Auditor, pp. 63-67. pp. 91-112. Searcy D, Woodroof J & Behn B 2002, ‘Continuous Li, Shing-Han, Huang, Si Ming & Lin, YCG 2007, Audit: The Motivations, Benefits, Problems, ‘Developing A Continuous Auditing Assis- and Challenges Identified by Partner of a Big 4 tance System Based On Information Process Accounting Firm’, Proceedings of the 36th Hawaii Models’, Journal of Computer Information Sys- International Conference on System Sciences. tems, pp. 2-13. Shih, KH, Cheng CC & Wang YH 2011, ‘Financial Majdalawieh, Munir, Zaghloul & Issam, 2009, ‘Para- Information Fraud Risk Warning For Manufac- digm shift in information systems auditing’, turing Industry -Using Logistic Regression Managerial Auditing Journal, 24, pp. 352 – 367. And Neural Network’, Romanian Journal of Eco- Marks, Norman, 2010, ‘Continuous Auditing Reex- nomic Forecasting. amined’, Isaca Journal, Volume 1, pp. 1 - 5. Spelt David and Balsters Herman 1997, ‘Automatic Marasco, Jim, 2011, Is your organization susceptible Verification of Transactions on an Object- to fraud?, viewed 25 April 2012, Oriented Database’, Proceedings of the Workshop http://www.efprotenberg.com/whats-new- on Database Programming Languages (DBPL), Es- articles-publications-susceptible-to-fraud. tes, Springer. McCarthy WE 1979, ‘An Entity-Relationship View Sutton, SG 2006, ‘Enterprise Systems and The Re- of Accounting Models’, The Accounting Review, Shaping of Accounting Systems: A Call of Re- October 1979, pp. 667-86. search’, International Journal of Accounting In- McDonough, J and McDonough, S 1997, ‘Research formation Systems, Vol. 7, pp. 1-6. Methods for English Language Teachers’, Lon- Swanborn, P 2010, Case Study Research: What, Why don: Arnold. and How?’ Sage, Englewood Cliffs, CA. Nielsen, 2010, ‘Retail and Shopper Trends Asia Pa- The Panel on Audit Effectiveness 2000, ‘Report and cific 2010: The latest in retailing and shopper Recommendations’, Exposure Draft - May 31, trends for the FMCG industry. 2000, Stamford, Public Oversight Board. Nigrini, MJ & Mittermaier LJ 1997, ‘The Use Of Vasarhelyi MA & Halper FB 1991, ‘The Continuous Benford’s Law As An Aid In Analytical Proce- Audit of Online Systems, Auditing: A Journal of dures Auditing’ A Journal of Practice and Theory, Practice and Theory’, pp. 10. pp. 52-67. Vasarhelyi, MA, & Greenstein, M 2003, ‘Underlying Olsen DH 2012, ‘Enhancing Integrity by Integrating Principles of the Electronization of Business: A Business Rules, Triggers, and Active Database Research Agenda’, International Journal of Ac- Techniques,’ IACIS, viewed 28 April 2012 counting Information Systems, 4, pp. 1-25. . Fraud, Cross Cultural Management’, Interna- Orman LV 2011, ‘Database Audit and Control tional Journal, 10, pp. 40 – 54. Strategies’, Information Technology and Manage- Whitten JL, Bentley LD & Dittman KC 2005, System ment, 2, 2001, pp. 27-51. Analysis and Design Methods, McGraw Hill. Pathak J, Chaouch B, Sriram RS 2005,’Minimizing Yin, Robert K 2009, Case Study Research: Design and Cost of Continuous Audit: Counting and Time Methods, 4th, SAGE Publications, Inc. Dependent Strategies’, Journal of Account and Zhao, Ning; Yen, David C, Chang I-Chiu 2004, ‘Au- Public Policy, 24:1, pp. 61-69. diting in the E-Commerce Era’, Information Man- Peslak, Alan R 2005, ‘Incorporating Business Proc- agement & Computer Security’, 12, p. 389-400. esses and Functions: Addressing the Missing Element in Information Systems Education’, ACKNOWLEDGEMENT Journal of Computer Information Systems, 2005, Note: a part of this article titled “Continous Audit- pp. 56-61. ing, Developing Automated Audit of The Systems Protivity, 2006, The Latest In Retailing And Shop- for Fraud and Error Delections”, was also pub- per Trends For The FMCG Industry: The Latest lished in the proceedings 3rd International Confer- In Retailing and Shopper Trends For The ence on Business and Business and Banking (ICBB), FMCG Industry, Protivity Inc. 5-7 February 2014, in Pattaya, Thailand.

138 Journal of Economics, Business, and Accountancy Ventura Vol. 17, No. 1, April 2014, pages 127 – 144

APPENDICES

Table 2 Audit Program and Findings-Prepare Purchasing Plan Risk Purchasing Plan made by people who do not have authorization, exceeding budget and made late over a specified date Findings (Records) No. Auditing Objects Assertions Key Control Auditing Rules CA TA 1 Purchasing Plan Occurrence Check if the user exists in 3 0 must be made by in user file exist in authorized users Check if the user exists in exist in transactions 2 Purchasing Plan Allocation Check whether the in add with budget ing plan has exceeded in a predetermined is budget greater than in

Check if there is a total If in add with chasing plan has ex- in ceeded a predeter- mined budget and if is greater than in exists check, whether check there is an authoriza- tion. 3 Purchasing Plan Occurrence 1. Check if there is in is not determined date late over a determined date 2. Check if there is Check < Date> in each is not Monday

4 All Purchasing Completeness Check if all purchasing is sequence of 63 11 Plan are recorded plan are recorded in and no duplicate Purchasing File document number Reliability Check if there is dupli- Check Duplicate 27 9 cate Purchasing Plan in number

139 Gregorius Rudy Antonio: Continuous auditing: …

Table 3 Audit Program and Findings-Place Purchasing Order Risk Purchasing Order made by people who do not have authorization, exceeding budget and made not appropri- ate with Purchasing Plan Findings (records) No. Auditing Objects Assertions Key Control Auditing Rules CA TA 1 Purchasing Order Occurrence Check if the user exists 1. in exist in authorized users 2. in exist in 2 0 in user file for the past transactions 2 Purchasing Order Allocation Check whether the in add with in is budget greater than in

Check if there is a total If in add with in is mined budget and if greater than in exists check, whether check tion. 3 Purchase Order is Occurrence Check if there is pur- , , 921 127 not appropriate chasing order is not in is equal with purchasing plan purchasing plan , < Quantity >, in 4 All Purchasing Completeness Check if all purchasing is sequence of 256 34 Order are recorded order are recorded in and no duplicate Purchasing File document number Reliability Check if there is dupli- Check Duplicate 13 0 cate Purchasing order in number

140 Journal of Economics, Business, and Accountancy Ventura Vol. 17, No. 1, April 2014, pages 127 – 144

Table 4 Audit Program and Findings-Receive Inventory Risk Receiving made by people who do not have authorization, exceeding budget and made not appropriate with Purchasing Order Temuan (records) No. Auditing Objects Assertions Key Control Auditing Rules CA TA 1 Receiving Report Occurrence Check if the user exists in exist in authorized users in exist in 4 0 in user file for the past transactions

2 Receiving Report is Occurrence Check if there is receiv- , , in is equal Purchase Order chasing order with , , in 3 Receiving Report Occurrence Check if there is receiv- in is not greater determined date determined date in than in

4 Inventory has Valuation Check if there is inven- in 121 0 value 0 tory has 0 value is null or 0

5 All Receiving Re- Completeness Check if all receiving is sequence of 311 132 port are recorded report are recorded in and no duplicate Purchasing File document number Reliability Check if there is dupli- Check Duplicate 42 31 cate receiving report in number

141 Gregorius Rudy Antonio: Continuous auditing: …

Table 5 Audit Program and Findings–Pay Vendor Risk Payment to vendor more than the inventory sold or the inventory received Temuan (records) No. Auditing Objects Assertions Key Control Auditing Rules CA TA 1 Vendor Payment Occurrence Check if the user exists in 0 0 must be made by in user file exist in authorized users Check if the user exists in 0 0 in user file for the past exist in transactions

2 Payments to Ven- Accuracy, Check whether there is in is 14 0 dors must be no Right and a payment that greater not greater than larger than it Obligation, than the total of proper in X in should be paid Classification, Purchase Order which Cut off has been adjusted to the quantity of stocks received in Receiving Report

3 Payments to Con- Accuracy, Check whether there is in is 73 0 signment Vendors Right and a payment that greater not greater than must be no larger Obligation, than the total of proper in X in than it should be Classification, Purchase Order which paid Cut off has been adjusted to of in sales invoice 4 All payable are Completeness Check if all payment is sequence of 5 5 recorded and no are recorded in Pay- duplicate docu- able File ment number Reliability Check if there is dupli- Check Duplicate 3 3 cate payable number in

142 Journal of Economics, Business, and Accountancy Ventura Vol. 17, No. 1, April 2014, pages 127 – 144

Table 6 Audit Program and Findings-Create Invoice Risk Invoice created by users who are not authorized and there are selling with unauthorized loss Temuan (records) No. Auditing Objects Assertions Key Control Auditing Rules CA TA 1 Invoice must be Occurrence Check if the user exists in exist in ized users Check if the user exists in user file for the past in < SalesDetail transactions > exist in 11 0

2 Every sales has a Valuation Check if there is a in is 452 0 profit expect there lower selling Price lower than in is authorization than Cost of goods and check sold, if exist there is an in exist in 3 COGS equal to 0 Accuracy Check if there are sales in 1023 0 that have a zero or null is equal with 0 HPP 4 All Invoice are Completeness Check if all Invoice are is sequence of 784 475 recorded and no recorded in Sales File duplicate docu- ment number Check if there is dupli- Check Duplicate 189 124 cate Invoice number in

Table 7 Audit Program and Findings-Customer Payment Risk Customer payment received is not as it should be Temuan (records) No. Auditing Objects Assertions Key Control Auditing Rules CA TA 1 Payment must be Accuracy Check if there is a in is 162 0 equal with the in- payment that is not not Equal with in voice equal with the invoice

143 Gregorius Rudy Antonio: Continuous auditing: …

Table 8 Audit Program and Findings-Collection of Payments & Correction of Collection of Payment per Cashier Risk Cash Receipted from the sale over the tolerance Rp. 50,000 of the total sales made for each cashier. Temuan (records) No. Auditing Objects Assertions Key Control Auditing Rules CA TA 1 Collection of Pay- Occurrence Check if the user exists in 532 0 ments must be in user file exist in made by author- Check if the user exists ized users in user file for the past in exist in

2 Cash Receipted Accuracy Check if there is a in is 2634 1934 from the sale over cashier deposit that is not equal with ( Rp. 50.000 the tolerance Rp. not the same with cash + r> 50,000 of the total register sales in ) sales made for each cashier. 3 Every cash excess Accuracy, Check if there is excess (Sum in 65 0 has been inputted Classification cash that has not been each Cahier) - < Sales- inputted cashier at the DateCashier > in < De- corrections posit > is equal with in 4 All collection of Completeness Check if all Invoice are is sequence 423 0 customer payments recorded in Sales File of are recorded and no duplicate Check if there is dupli- Check Duplicate in

Table 9 Findings Summary Findings (records) Difference Difference No. Process CA MA (records) (%) 1 Prepare Purchasing Plan(table 1) 1908 133 1775 1334.5 2 Place Purchasing Order(table 2) 1406 227 1179 519.3 3 Receive Inventory(table 3) 1241 394 847 214.9 4 Pay Vendor(table 4) 95 8 87 1087.5 Total Findings - Purchase 4650 762 3888 510.24 5 Create Invoice(table 5) 2991 599 2392 399.33 6 Apply Payments(table 6) 162 0 162 N/A 7 Collection of Payments & Correction of Collection of 3714 1934 1780 92.04 Payment per Cashier(table 7) Total Findings - Sales 6887 2553 4334 169.76 Total Findings 11517 3295 8222 249.53

144