Build a Robust Continuous Audit Program in 10 Steps

In an increasingly dynamic and complex business environment, periodic audits may not provide timely insights for your organization to navigate risks effectively. That's where continuous auditing steps in. A constant audit program can offer a near real-time assessment of an organization's operational and financial performance and identify control deficiencies, potential fraud, and compliance issues. But how can you build an effective continuous audit program?

In this blog post, I’ll discuss 10 steps that you can use to build a robust continuous audit program at your organization. I’ll also note how the benefits, tools, and resources of a CIS SecureSuite Membership can help you along the way. Let’s get started.

1. Understand the Basics of Continuous Auditing

Continuous auditing involves the frequent or real-time assessment of your organization's operations. This doesn’t mean that you need to conduct an audit every day. Instead, it’s about using automation to be proactive rather than reactive with your audits.

As such, continuous audits aren’t the same as traditional audits. The latter involves assessing specific control requirements and technology to provide the information in a traditional sense, i.e., to store and curate the audit requirements. It also occurs annually or semi-annually.

By contrast, in continuous auditing, you use technology and tools as the assessment method to monitor processes and to understand if a control is effective. You benchmark the control to continually assess if its current condition fits within the corresponding control parameters. Understanding this shift from periodic to constant auditing is the first step in building your program.

2. Establish Your Objectives

Determine what you want to achieve with your continuous audit program. Is it to improve the effectiveness of your internal controls? Enhance compliance with regulations? Detect fraud more rapidly? Your objectives will guide the design and implementation of your program.

Not sure what your unique goals are? In general, you can use a continuous audit program to gain assurance of a control being sustainable over a period of time. It also helps you to address exceptions to the control parameter and identify weak controls early, thus reducing the risk of exposure of a misaligned/configured control.

3. Assess Your Current Audit Process

Review your existing audit process to identify gaps and areas of improvement. Here are some ideas of where to look:

• Current audit scope – Are system assessments looking at all systems or just those defined as critical?
• Method of assessment – What timing requirement is in place? Is it just annual reviews? Should those be more often and/or take place after a major cyber event?
• Sample size – Does this change with growth or shrinkage within your organization?

Consider the technologies, techniques, and resources currently in place and how you can leverage and/or enhance them for continuous auditing.

4. Define Key Risk Indicators

Identify the key risk indicators (KRIs) to be monitored through continuous auditing. These should align with your organization's risk appetite and strategic objectives. KRIs could include financial metrics, operational metrics, or other indicators of risk and performance.

Quick Tip: If you’re looking to identify KRIs that matter to you, consider looking at risks that can be measured using the metrics discussed above along with a set of key tolerance/appetite values to measure against. Additionally, you’ll want to ensure a consistent approach to measurement.

5. Leverage Technology in Your Toolbox

Continuous auditing relies heavily on technology. Automated data analysis tools, artificial intelligence, and machine learning can monitor large volumes of transactions and controls in real time. Invest in technologies that align with your continuous audit objectives and capabilities.

This is where a CIS SecureSuite Membership can help. It enables you to streamline your implementation of security best practices by using resources such as the pro version of our CIS Configuration Assessment Tool (CIS-CAT Pro) and the CIS Build Kits. The former helps you to conduct automated scans of your systems’ settings against the security recommendations of the industry-leading CIS Benchmarks. In this way, CIS-CAT Pro saves you time and money in visualizing the current state of your system hardening efforts.

From there, you can conserve even more effort by implementing one of our Build Kits. Available as Group Policy Objects (GPOs) on Windows devices and as Bash shell scripts on Linux machines, the Build Kits automate the “Remediation” section of the CIS Benchmarks. They’re designed to help you apply all of the secure configurations of a Benchmark at once without having to manually apply the recommendations one by one.

Our video below has more information on how you can use the CIS Build Kits to easily apply secure configurations in your environments.

 

 

Please note that your organization has unique needs and requirements, so the process of integrating technology like CIS-CAT Pro and the Build Kits into your processes will look different from another’s journey. Say you’re in a data-heavy industry such as eCommerce, for instance. It will be easy for you to build automated assessment tools into current processes. By contrast, if you’re in a sector with less emphasis on data, you may have to adapt analytic and audit capabilities to find an approach that works for you.

6. Develop an Audit Plan

Outline your continuous audit plan, detailing the scope of the audit, the KRIs to be monitored, the technology and techniques to be used, and the frequency of reporting. Remember, continuous auditing doesn't mean continually auditing everything – it means auditing the right things at the right time.

You want to understand if your control is effective before an adversary tests it. The same thing with hygiene. You want to practice good hygiene now and not wait until it is too late. For example, you want to test your systems for up-to-date patches based on a known vulnerability. Having that assurance provides some respite against exploitation of your systems. You want to know what patches are in place before a vulnerability is announced.

One of the ways you can practice good hygiene now is by downloading the pro version of our CIS Controls Self Assessment Tool (CIS CSAT Pro), another resource available through a CIS SecureSuite Membership. You can use it to track and prioritize your implementation of the CIS Critical Security Controls (CIS Controls), including Implementation Group 1 (IG1) – the definition of essential cyber hygiene. With CIS CSAT Pro, you can map out a way to strengthen your defenses against common cyber threats in a way that works for you.

Want to learn more about laying a secure foundation with IG1? Check out our video below.

 

 

7. Train Your Team

Your audit team will need the skills and knowledge to implement and manage the continuous audit program. This might require training in new technologies/techniques or bringing in new team members with specialized skills, including data analysis, red teaming skill sets, and skills on technologies that the organization is using.

8. Pilot and Refine

Before rolling out your continuous audit program organization-wide, consider piloting it in one area or process. This will allow you to refine your approach, troubleshoot any issues, and demonstrate the value of continuous auditing.

Quick Tip: If you’re looking to create a pilot, start small and identify systems that will fit the paradigm of continuous assessment. This will help you to gain some wins in assessing how to scope the assessment of continuous control and use these as lessons for evolving the program. Continuous auditing is not a “big bang” approach.

9. Communicate and Collaborate

Continuous auditing can represent a significant change, so effective communication and collaboration are essential. Engage with stakeholders across the organization to explain the benefits of constant auditing, address any concerns – notably, the resources required to keep this program operational and the burden it imposes on systems, resources, and costing – and ensure everyone understands their role in the process.

Here's another place where a CIS SecureSuite Membership can help. Within CIS CSAT Pro, you can assign team members and stakeholders to different steps of an implementation task. That way, you can make sure that key individuals support your efforts to enact a CIS Safeguard and, by extension, contribute to your continuous auditing program over the long term.

10. Review and Adapt

Finally, remember that continuous auditing itself should be subject to constant improvement. Regularly review your program's effectiveness and adapt it as needed, considering changes in your business environment, risk landscape, and technological capabilities.

Continuous Auditing as a Journey

 

Check out our related blog posts:

Want to start building a continuous auditing program in the meantime?

 

---

About the Author

Sean Atkinson
Chief Information Security Officer

Sean Atkinson is Chief Information Security Officer of CIS. He uses his broad cybersecurity expertise to direct strategy, operations, and policy to protect CIS’s enterprise of information assets. His job responsibilities include risk management, communications, applications, and infrastructure. Prior to CIS, he served as the Global Information Security Compliance Officer for GLOBALFOUNDRIES, serving Governance, Risk and Compliance (GRC) across the globe.

Prior to GLOBALFOUNDRIES, Atkinson led the security implementation for the New York State Statewide Financial System (SFS) implementation from 2007 to 2014, and his last role and responsibility was as the Internal Control, Risk and Information Security Manager.

Atkinson was born in Brooklyn, N.Y. and lived in England for 18 years, graduating from Sheffield Hallam University in 2000. After moving back to the United States, he has pursued multiple degrees and certifications in the IT arena.

In addition to his work with CIS, Atkinson is also an adjunct professor of Computer Science at the College of Saint Rose.