Identifying the Absence of Effective Internal Controls: An Alternative Approach for Internal Control Audits

Michael Werner, Nick Gehrke

Publikation: Bidrag til tidsskriftTidsskriftartikelForskningpeer review

402 Downloads (Pure)


Auditors face new challenges when auditing internal controls due to the increasing integration of information systems for transaction processing and the growing amount of data. Traditional manual control testing procedures become inefficient or require highly specialized and scarce technical knowledge. This study presents audit procedures that follow a new approach. Instead of manually testing internal controls, automated procedures search for the absence of those controls. Process mining techniques are combined with advanced statistical analysis where process mining serves as a data analysis technique to create process models from the recorded transaction data. These are searched for critical data constellations in combination with an exploratory factor analysis to identify systematic deficiencies in the internal control system. The manual and time intensive inspection of individual controls is replaced by automated audit procedures that cover the totality of recorded transactions. The study follows a design science approach and uses case study data for illustration.
TidsskriftThe Journal of Information Systems
Udgave nummer2
Sider (fra-til)205-222
Antal sider18
StatusUdgivet - jun. 2019

Bibliografisk note

Published online: 20. March 2018


  • Auditing
  • Internal control system
  • Monitoring
  • Compliance
  • Data analysis
  • Journal entry data
  • Process mining
  • Enterprise resource planning systems
  • Exploratory factor analysis
  • Indicators