Auditing during a pandemic – can continuous controls monitoring (CCM) address challenges facing internal audit departments?

Abstract

Purpose During a pandemic, with businesses implementing social distancing protocols and work-from-home strategies, the use of continuous controls monitoring (CCM) may add value to the internal audit function. This study aims to examine the use of CCM technologies and the impact on the internal audit function during a pandemic. Design/methodology/approach This study adopted a case study approach for this study because it focuses on questions of “how” and “what.” Case studies provided an opportunity for an in-depth analysis of the phenomena being investigated. Semi-structured interviews were used to collect data. This study did not use sampling. Instead, multiple case studies were used for data collection. Findings Based on the findings, this study makes several contributions to the literature, for example, in health-care evidence suggests the pandemic has caused internal audit to focus on risk areas. Other industries, such as retail, have invested in CCM. However, in all cases, education and preparedness (or the lack thereof) appeared to significantly influence uptake of CCM. Organizations that made prior investments in CCM technologies experienced greater acceptance in the face of changing demands. Training in emerging technologies is a key competency in supporting audit operations in changing environments. Research limitations/implications As the study was conducted with a small sample of cases, findings cannot be extrapolated nor generalized beyond the case study organizations. Practical implications This study found that several factors limit adoption, exploitation and further development of CCM technologies, such as lack of top management support, acceptance of CCM technologies and suitable education and training of internal audit staff. Originality/value This study addresses the issue of the value that CCM offers organizations and whether it is a silver bullet that the internal audit profession needs, particularly when physical access to organizations may be restricted. The COVID-19 pandemic placed considerable focus on digital access. Better IT systems and more data will allow organizations to better support employees, inform strategic and financial decisions and engage stakeholders. During the recovery phase, leveraging investments in CCM technologies will contribute to internal audits’ ability to help clients to manage organizational risk.