CPAS/CCM experiences: Perspectives for AI/ES research in accounting;

              The CPAS / CCM1 experiences: Prospectives for AI/ES research in Accounting
Miklos A. Vasarhelyi
Rutgers University
INTRODUCTION
This paper discusses the findings from the Continuous Process Audit System2 (CPAS) and Continuous Control Monitoring (CCM) efforts and extrapolates into areas of potential research in AI & ES in Accounting. First we describe the motivation and key factors in the CPAS efforts, then we show how an effort a la CCM3 can be applied onto the basic framework. In the next section we discuss some technological features and problems. Then the prospective approaches for the problems found are discussed. Finally the conclusions section summarizes the discussion and proposes some additional routes for future research.
ELEMENTS OF THE CPAS EFFORT
The CPAS project was motivated by a survey of an Internal Audit organization that identified large corporate systems as potentially a very large exposure for the corporation. The CPAS methodology was developed to measure and detect any major problems that may be occurring during the day-to-day operation of large corporate computer systems. The methodology initially focused on very large main-framed corporate legacy systems where more than one copies of a system ran in multiple data-centers around the country. Later developments allowed for the conceptualization of the process in distributed and client-server environments.
Basic concepts
The placement of software probes into large operational systems for monitoring purposes may be an intrusion on the system and can result in performance deterioration. The installation of these monitoring devices must be planned to coincide with natural life-cycle changes of major software systems. Interim measures should be implemented to prepare for online monitoring.
The CPAS effort consisted of a data provisioning system and an advanced decision support system. Data can be gathered from tailored reports (files) from the application, reports from the application, and direct monitoring data. The approach used in CPAS is dual, evolving from a measurement phase without intrusion and minor system overhead, to a monitoring phase where intrusion is necessary4 but audit capability is substantially expanded.
1 CPAS stands for Continuous Process Auditing, CCM stands for Continuous Control Monitoring
2 Vasarhelyi, M. A. & Halper, F. B., "The Continuous Audit on Online Systems," Auditing: A Journal of Practice & Theory.
Vol. 10, No. 1, Spring 1991, pp. 11-125.
3 Vasarhelyi, M. A. & Halper, F. B., "Continous Control Monitoring," a monograph submitted to the Institute of Internal Auditors, forthcoming, 1996.
4 Intrusion and system overhead may be limited by utilizing database backup and recovery traces as the main source of transaction
data, dumping a copy of these traces onto a local workstation, loading the workstation with some expert software and having it as a local interchange device.
45