Recent research efforts by Kuhn and Sutton 2006, Alles et al. 2006, and Alles et al. 2008
offer evidence of the viability of an MCL continuous auditing approach in an ERP environment.
As an example of how fraudulent activities at WorldCom could have been detected earlier, Kuhn
and Sutton 2006 lay out the design specifications for integrating a specific set of metrics appropriate
for the WorldCom financial reporting system that could have been used to continuously
monitor transactions. The study demonstrates how financial transaction data i.e., journal entries
can be extracted from the client database layer without any direct processing inside the client
system. Both Alles et al. 2006 and Alles et al. 2008 document a functioning system prototype
developed at Siemens for the continuous monitoring of business process controls and the detection
of exceptions to those controls. The prototype demonstrates the use of ABAP SAP’s unique
language programming to extract the business process control data from Siemens’ ERP system.
The two studies differ on several key aspects. Kuhn and Sutton 2006 design continuous auditing
procedures for the testing of financial transactions based on an historical case of financial reporting
fraud. Alles et al. 2006 and Alles et al. 2008, on the other hand, implement a continuous
auditing system for the testing of internal controls in a live environment.
Table 1 presents general characteristics for continuous auditing systems and how various
architectural types compare on those traits. The remainder of this section focuses on analysis of
the issues and concerns associated with each approach, including some that all approaches share.