Business process modeling approaches in the context of process level audit risk assessment: An analysis and comparison

Abstract

Current auditing standards emphasize the importance of auditors gaining a broader understanding of an organization's operations to perform risk assessment (i.e. assess the risks of material misstatement). Auditors' ability to effectively analyze operations in the form of business processes is by definition a key determinant of their ability to appropriately plan and conduct the audit. However, to date there has been little consideration of how best to represent or organize the information required about business processes for audit risk assessment purposes. This paper identifies a number of commonly used business process modeling conventions, and characterizes them relative to the needs of auditors in performing risk assessments at the business process level. To provide a context for the process modeling conventions examined, international standards on enterprise modeling are outlined, and the constructs they identify are compared to those identified as needed for process level risk assessment. This comparison helps provide some assurance that the knowledge needed for audit risk assessment at the process level is similar to that needed for management understanding and control of business processes more generally. A number of commonly used business process modeling conventions are identified based on a literature review, including data flow diagrams, system flowcharts, REA models, event process chains, IDEF0 and IDEF3, UML diagrams, and business process diagrams (BPMN). The constructs represented in each of these models are compared to those identified as needed for process level audit risk assessment, and the merits of each convention are discussed. The paper concludes by noting particular areas where additional research is needed before more definitive answers regarding which process modeling conventions are most appropriate for auditor use are possible.