A 90-Day Continuous Auditing Pilot for Accounts Payable

Moving from periodic transaction testing to continuous fraud-risk monitoring

Ray Romero, CPA, CIA, CFE, MBA Founder & Managing Director INTELL RISK & ADVISORY GROUP

The Limitations of Traditional Audit Sampling

Accounts payable is among the most transaction-intensive functions within an organization, often involving thousands of invoices, vendor changes, approvals, and disbursements each month. Within that volume, duplicate payments, fictitious vendors, unauthorized transactions, and control overrides can remain undetected for extended periods, particularly when oversight relies primarily on periodic reconciliations and traditional audit sampling.

Although sampling remains an essential audit technique, it provides limited coverage of the broader transaction population and may not identify unusual patterns developing between audit cycles. Continuous auditing addresses these limitations by systematically analyzing transaction data to identify exceptions, evaluate control effectiveness, and provide more timely information about emerging financial and operational risks. The objective is not to replace traditional audit procedures or professional judgment, but to expand audit coverage and strengthen the organization's ability to identify and respond to potential control failures.

Why Accounts Payable Is an Ideal Starting Point

Accounts payable provides a practical environment for implementing continuous auditing because its transactions are generally structured, recurring, and accessible through enterprise financial systems. Vendor master records, invoice registers, purchase orders, approval histories, and payment files contain information that can be evaluated through repeatable analytical procedures. When these data sources are properly integrated and validated, they can provide valuable insight into transaction patterns, control performance, and potential fraud exposure.

Common risks include duplicate invoices, fictitious vendors, unauthorized banking changes, split payments designed to circumvent approval thresholds, unusual transaction timing, and payments inconsistent with established vendor activity. However, identifying an exception is only the beginning of the examination. A duplicate banking relationship, for example, may indicate an inappropriate vendor arrangement or reflect a legitimate business circumstance. Internal Audit must evaluate the underlying transactions, examine supporting documentation, and determine whether the evidence substantiates a control deficiency or warrants further investigation.

Establishing a 90-Day Continuous Auditing Pilot

Rather than implementing an enterprise-wide monitoring program immediately, organizations can begin with a focused 90-day pilot designed to evaluate the feasibility, effectiveness, and potential benefits of continuous auditing. The pilot should establish measurable objectives, identify significant accounts payable risks, develop appropriate analytical procedures, and determine whether the resulting information improves the organization's ability to identify exceptions and strengthen controls.

Days 1–30: Understand the Process and Establish the Baseline

The initial phase begins with a comprehensive assessment of the organization's procure-to-pay process, including vendor onboarding, purchasing, invoice processing, payment authorization, and cash disbursements. Internal Audit should identify the relevant transaction flows, evaluate existing control activities, and determine where management overrides, inadequate segregation of duties, or weaknesses in system access could create opportunities for unauthorized activity.

Equally important is the assessment of data reliability. Before performing analytical procedures, the audit team must determine whether the available records are complete, accurate, and sufficiently detailed to support the intended tests. This may require reconciling extracted transaction populations to general ledger balances, evaluating data-field definitions, and confirming that relevant historical records and system-generated timestamps are available. The results establish a baseline against which future exception rates, control performance, and monitoring effectiveness can be evaluated.

Days 31–60: Develop and Execute Continuous Audit Tests

During the second phase, Internal Audit develops analytical procedures designed to identify specific fraud risks and control weaknesses. Rather than relying exclusively on selected samples, these procedures can evaluate the entire relevant transaction population, providing broader coverage and identifying relationships that may otherwise remain undetected.

Initial testing should focus on risks that are both significant and measurable through available data.

Each procedure should have documented objectives, test logic, defined exception criteria, and an assigned reviewer. Initial results must be evaluated to distinguish genuine control concerns from legitimate business activity, and test parameters should be refined as the organization develops a better understanding of transaction patterns and false-positive rates.

Although continuous auditing may provide 100% coverage of selected transaction populations, that coverage should not be confused with the ability to detect every instance of fraud. Analytical procedures remain dependent on data quality, the appropriateness of the test design, and the specific behaviors being examined. Accordingly, identified exceptions require professional evaluation and corroborating evidence before conclusions are reached.

Days 61–90: Investigate Exceptions and Report Results

The final phase focuses on evaluating the significance of identified exceptions, determining their underlying causes, and assessing whether the monitoring procedures provide meaningful information for management and the Audit Committee. Internal Audit should prioritize exceptions based on risk, reconstruct relevant transactions, examine supporting documentation, and determine whether unusual activity reflects legitimate business circumstances, control deficiencies, or matters requiring further investigation.

The resulting analysis should distinguish isolated processing errors from recurring or systemic weaknesses. For example, repeated unauthorized vendor banking changes may indicate deficiencies in access controls, approval procedures, or independent verification requirements. Identifying the underlying cause allows management to implement corrective actions that address the weakness rather than merely resolving individual exceptions.

At the conclusion of the pilot, Internal Audit should present management and the Audit Committee with a clear assessment of the procedures performed, transaction coverage achieved, significant exceptions identified, and recommendations for strengthening the control environment. The report should also address data limitations, implementation challenges, resource requirements, and whether expanding the monitoring program would provide sufficient value to justify additional investment.

Measuring the Effectiveness of the Pilot

A successful pilot should be evaluated through measurable performance indicators rather than the volume of alerts generated. Relevant measures include transaction coverage, exception frequency, confirmed exception rates, false-positive rates, time to detection, resolution time, verified financial impact, and the status of corrective actions. These indicators help determine whether continuous auditing improves risk identification and control oversight while maintaining a reasonable investigative workload.

Management should establish appropriate baseline measures and evaluate whether the pilot produces a meaningful improvement over existing control activities. Financial benefits should be supported by documented evidence, and estimates of potential exposure should be distinguished from actual recoveries or verified losses prevented.

From Continuous Auditing to Predictive Analytics

A successful continuous auditing pilot can establish the foundation for more advanced fraud-risk analytics by generating historical transaction data, identifying recurring exceptions, and documenting the results of investigative procedures. Over time, this information can support risk scoring, trend analysis, and predictive models designed to identify combinations of risk indicators that may not be apparent when transactions are evaluated independently. For example, a recently established vendor, a change in banking information, an unusually large invoice, and an expedited payment request may each have a legitimate business explanation. However, when these conditions occur together, they may indicate a heightened risk that warrants additional examination.

This progression also supports the development of a more dynamic, risk-based internal audit operating model in which continuous monitoring and predictive analytics inform ongoing risk assessments and audit prioritization. Rather than relying exclusively on annual risk assessments and predetermined audit schedules, Internal Audit can use emerging risk indicators to adjust its focus, allocate resources more effectively, and provide management and Audit Committees with timely, forward-looking assurance.

The operating model can be summarized as follows:

Enterprise Data → Continuous Risk Indicators → Dynamic Risk Assessment → Audit Prioritization → Assurance → Governance Reporting

This framework represents a shift from predominantly retrospective auditing toward a more responsive approach to evaluating emerging risks, while preserving the independence and professional judgment required of the internal audit function.

Governance, Accountability, and Internal Audit Independence

An important consideration in implementing continuous auditing is the distinction between management's responsibility for operating internal controls and Internal Audit's responsibility for providing independent assurance. Management remains accountable for authorizing transactions, reviewing exceptions, implementing corrective actions, and maintaining effective control activities. Internal Audit evaluates the design and operating effectiveness of those controls and provides objective assessments of the organization's risk management and governance processes.

Organizations should establish clearly defined responsibilities for maintaining analytical procedures, reviewing alerts, investigating exceptions, and reporting significant findings. Where Internal Audit provides advisory assistance in developing a monitoring framework, appropriate safeguards should be established to avoid assuming management responsibilities or impairing subsequent assurance activities. These arrangements should be consistent with the Institute of Internal Auditors' Global Internal Audit Standards.

The Business Case for Continuous Auditing

A 90-day accounts payable pilot provides a manageable way to evaluate continuous auditing without immediately committing to an enterprise-wide technology initiative. By focusing on a defined transaction population and a limited set of significant risks, an organization can assess whether expanded analytical coverage improves the identification of control weaknesses, reduces the time required to detect unusual activity, and provides more reliable information for management decision-making.

The pilot should also reveal practical implementation challenges, including data-quality deficiencies, system integration requirements, investigative capacity, and the ongoing costs of maintaining analytical procedures. These findings are essential to determining whether the program should be expanded, modified, or discontinued. A disciplined evaluation should consider both the potential benefits and the resources necessary to sustain effective monitoring.

Conclusion

Continuous auditing represents an opportunity to strengthen how organizations identify financial and operational risks, evaluate internal controls, and provide timely assurance. When properly designed, a focused accounts payable pilot can demonstrate the value of broader transaction coverage, earlier exception identification, and more systematic evaluation of control performance.

The ultimate objective is not to generate more alerts or introduce technology for its own sake. It is to provide management and the Audit Committee with reliable, actionable information that supports stronger controls, informed decisions, and earlier intervention when emerging risks are identified.

A successful pilot establishes more than an analytical capability. It provides an evidence-based foundation for determining whether continuous auditing should become an integral component of the organization's internal audit and fraud-risk management strategy.

Professional References

• The Institute of Internal Auditors, Global Internal Audit Standards, effective January 2025.
• The Institute of Internal Auditors, GTAG: Continuous Auditing—Coordinating Continuous Auditing and Monitoring to Provide Continuous Assurance, Second Edition.
• Committee of Sponsoring Organizations of the Treadway Commission (COSO), Internal Control—Integrated Framework.
• Association of Certified Fraud Examiners, Occupational Fraud 2024: A Report to the Nations.

INTELL RISK & ADVISORY GROUP Complex Matters. Evidence-Based Answers.

Ray Romero, CPA, CIA, CFE, MBA Founder & Managing Director

Fraud | Forensic Accounting | Investigations | Litigation Support | Expert Witness | Internal Audit | Complex Accounting | Due Diligence & M&A

Confidential inquiries: ✉ inquiries@intellriskadvisory.com
☎ (408) 782-4131