A Model for Investigating Internal Control Weaknesses

Abstract

Scandals in corporate finance in the early 2000s and subsequent policy changes led corporate executives to adopt a more risk-based approach in corporate governance. Therefore, identification and assessment of risks became extremely important. Risk assessment poses a particular challenge for auditors due to the highly complex structure and processes of internal control systems. Extant research in this area mostly focused on probabilistic models and expert systems that capture and model heuristic knowledge. However, evidence suggests that knowledge of the structure of the internal control system is also essential. There is relatively little research that focuses on the modeling of the structural aspects of financial processes and their internal control systems as a means of helping corporate executives and auditors perform their respective tasks of risk management and assessment. This article proposes an approach to risk management and assessment in internal control systems that models the structure and financial processes of an internal control system. The model uses a directed graph to represent the various elements in an internal control system, such as financial statement assertions, control activities, financial processes, and the causal relationships that exist among these elements. The article demonstrates the usefulness of the model by presenting and discussing algorithms based on this model to help corporate executives manage risk and to help internal and external auditors assess risk, for designing substantive testing and for tracing sources of errors.

The impact of an IT governance framework on the internal control environment

“…The key role that IT and information security play in an overall system of internal controls is highlighted by numerous studies (Gordon et al , 2003; Canada et al , 2009; Kuhn et al , 2013). IT helps managers to perform effectively and efficiently, risk management activities (Guan and Levitan, 2012) and to evaluate IT-based control environments (Hunton et al , 2004). The adoption of effective IT controls provides important benefits to the entire firm or organization (Kimiloglu et al , 2012); this allows to monitor the control environment and consequently to improve the internal control system.…”