Continuous Auditing: Build the Evidence Chain Behind the Alert

Continuous auditing can bring risk signals closer to the events that matter. The useful change is not simply a dashboard that refreshes more often. It is a repeatable route from dependable data to a reviewed, evidence-based assessment, with its coverage and limitations visible.

Consider an original fictional food distributor. Its internal audit team wants to examine whether supplier bank-detail changes shortly before payment receive the expected verification. A quarterly review may discover an issue long after the payment. A recurring test could identify selected signals earlier, provided the extraction, rule and response process work as intended.

Define the assurance question before the rule

The question is whether the bank-change verification control operates as designed for the defined payment population. A candidate signal is a supplier bank change within 48 hours before payment. Forty-eight hours is an illustrative design parameter, not a professional standard or a validated fraud predictor.

Document which timestamp represents a change: an effective bank-detail change, a request, an approval or a system update can mean different things. Define the payment event, relevant timezone, supplier identifier, treatment of reversals and which records are excluded. A precise query can still answer the wrong business question.

In a fictional worked example, a change at 10:00 on 14 October followed by a payment at 09:00 on 15 October gives an interval of 23 hours. It triggers the illustrative rule. A change at 09:00 on 10 October followed by payment at 09:00 on 15 October gives 120 hours and does not trigger that rule. Neither result establishes whether the payment is legitimate or whether other risks exist.

Check the run before interpreting the result

A daily run should have evidence that it received the expected data. Reconcile record counts, relevant totals and identifiers to appropriate source controls. Investigate missing files, duplicate keys, unmatched suppliers and late-arriving changes.

Keep run health separate from business exceptions. A failed extraction with zero returned records must not appear as a healthy run with no exceptions. Record the last successful extraction, data period, completeness checks, execution time, rule version and any limitations.

“Not assessed” is more useful than an unsupported green status. It tells the reader that the intended question was not evaluated for the stated period or scope.

Make the response part of the design

A signal needs a route to a responsible reviewer. In this fictional design, accounts payable investigates the operational question and retains the relevant verification record. Internal audit independently evaluates whether the rule, supporting evidence and follow-up support its assurance objective. Operational payment decisions remain with authorized management.

For a flagged payment, inspect the change request, verification evidence, approval authority and payment trail. The alert may reflect a legitimate change, incomplete evidence, a data-matching issue or a control exception. Record the supported disposition rather than allowing an analyst to clear it merely to reduce the queue.

Management's recurring monitoring and internal audit's ongoing assessment can use related data while serving distinct responsibilities. Coordination can reduce duplicated effort, but it should not erase independence or make audit the owner of the process it assesses.

Govern the rule as the business changes

Version the logic, parameters and exclusions. Test a change before deployment and retain the reason, approval and expected effect. A changed payment process, migration or new supplier identifier may alter the meaning of a previously useful rule.

Review both flagged and relevant unflagged cases. Flagged-item review alone cannot reveal every blind spot. Challenge whether the rule misses a different sequence of events, whether complete data reaches it and whether the selected test can support the intended conclusion.

Read several measures together: extraction coverage, failed runs, unmatched records, unresolved signal age, recurrence and the evidence behind dispositions. A falling alert count can indicate improvement, a narrower rule or missing data. A fast closure time can reflect efficient investigation or premature clearance.

Report the boundary of assurance

A recurring rule does not make assurance continuous in an unlimited sense. A daily schedule has latency; missing feeds create gaps; a bank-change rule covers a particular risk indicator rather than every payment assertion. Professional judgment is still needed to combine the results with other evidence and determine the nature and timing of any assurance communication.

Start with one consequential question, one defined population and a response process that can be tested. Expand only when the evidence demonstrates that data quality, investigation capacity and rule governance can support the additional coverage. No improvement percentage or detected fraud result is claimed in this fictional case.

The IIA's public overview of its 2025 Continuous Auditing and Monitoring guidance provides relevant professional context. The case and operating design here are original Inside Assurance explanations, not a reproduction of that guidance or a claim of conformance.

The design test is practical: if the data fails, the rule changes or a signal remains unresolved, can the next reviewer see exactly what was assessed and what was not?

Inside Assurance — Beyond the numbers. Inside the business.