Integrated Approach Model of Risk, Control and Auditing of Accounting Information Systems

Abstract

The use of IT in the financial and accounting processes is growing fast and this leads to an increase in the research and professional concerns about the risks, control and audit of Accounting Information Systems (AIS). In this context, the risk and control of AIS approach is a central component of processes for IT audit, financial audit and IT Governance. Recent studies in the literature on the concepts of risk, control and auditing of AIS outline two approaches: (1) a professional approach in which we can fit ISA, COBIT, IT Risk, COSO and SOX, and (2) a research oriented approach in which we emphasize research on continuous auditing and fraud using information technology. Starting from the limits of existing approaches, our study is aimed to developing and testing an Integrated Approach Model of Risk, Control and Auditing of AIS on three cycles of business processes: purchases cycle, sales cycle and cash cycle in order to improve the efficiency of IT Governance, as well as ensuring integrity, reality, accuracy and availability of financial statements.Keywords: Risk, Control, Audit, IT Governance, Accounting Information Systems1 IntroductionThe high level of using the information technology in financial and accounting processes in organizations [1] results in an increase in research and professional concerns about the risks, control and audit of Accounting Information Systems (AIS).The risks and vulnerabilities of Accounting Information Systems may lead to material misstatements in financial reporting. Most times these risks have negative impact on the integrity, accuracy, reality and availability of financial reports [2]; [3]; [4]. In this context, risk and AIS control approach is central to both financial and IT audit processes and IT governance processes within the organization.In this study, researching financial and IT audit process relations, and using the concepts of risk and control, we developed and applied an integrated approach model of risk, control and auditing of AIS. The purpose of this model is the integration approach of risk, control and AIS audit in the IT audit processes and financial audit processes in order to improve the efficiency of IT Governance, as well as ensuring integrity, reality, accuracy and availability of financial statements.The paper is structured in four parts. In the introduction we presented the current research regarding the integrated approach of risk, control and auditing in the IT auditor's perception, as well as the financial auditor's perception and we showed the need to develop a model. In the second part, we presented the research methodology. In the third part, we presented the model development and we discussed the findings of applying the model. Finally, we presented our conclusions regarding the research.2 Literature ReviewRecent studies in the literature on the concepts of risk, control and auditing of AIS outline two approaches: (1) a professional approach in which we can fit ISA, COBIT, IT Risk, COSO and SOX [5]; [6]; [7]; [8]; [9]; [10], and (2) a research oriented approach in which we emphasize research on continuous auditing and fraud using information technology [11]; [12]; [13].According to IFAC-ISA 315 financial auditors must understand and analyze AIS, which can affect financial reporting particularly on: significant transactions systems for financial statements; automatic or manual control pro- cedures through which transactions are recorded, stored and processed in the general ledger, and reported in the Financial Statements; the process of obtaining and presenting the financial reports from the AIS [5].Also in the professional approach of the risk management process and ensuring the control of AIS, we noticed the COBIT 5 framework [6]. According to ISACA, COBIT 5 is the only business framework for the governance and management of enterprise IT. Analyzing the objectives and the content of COBIT 5, we can say that starting with this version, ISACA has an integrated approach model of the risk, control and auditing of AIS. …