Identifying the Absence of Effective Internal Controls: An Alternative Approach for Internal Control Audits

Michael Werner, Nick Gehrke

Research output: Contribution to journalJournal articleResearchpeer-review

971 Downloads (Pure)


Auditors face new challenges when auditing internal controls due to the increasing integration of information systems for transaction processing and the growing amount of data. Traditional manual control testing procedures become inefficient or require highly specialized and scarce technical knowledge. This study presents audit procedures that follow a new approach. Instead of manually testing internal controls, automated procedures search for the absence of those controls. Process mining techniques are combined with advanced statistical analysis where process mining serves as a data analysis technique to create process models from the recorded transaction data. These are searched for critical data constellations in combination with an exploratory factor analysis to identify systematic deficiencies in the internal control system. The manual and time-intensive inspection of individual controls is replaced by automated audit procedures that cover the totality of recorded transactions. The study follows a design science approach and uses case study data for illustration.
Original languageEnglish
JournalThe Journal of Information Systems
Issue number2
Pages (from-to)205-222
Number of pages18
Publication statusPublished - Jun 2019

Bibliographical note

Published online: 20. March 2018


  • Auditing
  • Internal control system
  • Monitoring
  • Compliance
  • Data analysis
  • Journal entry data
  • Process mining
  • Enterprise resource planning systems
  • Exploratory factor analysis
  • Indicators

Cite this