Audit Model Research Articles

Estimating excess visual loss from neovascular age-related macular degeneration in the UK during the COVID-19 pandemic: a retrospective clinical audit and simulation model

ObjectivesTo report the reduction in new neovascular age-related macular degeneration (nAMD) referrals during the COVID-19 pandemic and estimate the impact of delayed treatment on visual outcomes at 1 year.DesignRetrospective clinical...

Institutionally Sustaining or Abandoning Mandatory Joint Audits: The Contrasting Cases of France and Denmark

This study draws on two longitudinal case studies of the French and Danish joint audit models to understand and compare how mandatory joint audits have emerged and evolved. In both settings, joint audits appeared in the 1930s to increase auditors’ competence and independence. After a few decades of practice, joint audits became taken for granted, but in the 1980s, conglomerated audit networks attempted to circumvent the joint audit rule, entering into conflict with local auditors. In France, the main association of auditors adopted successive regulatory measures that prevented circumventing the model, therefore avoiding its erosion. Such regulatory layering crucially reshaped the model to sustain belief in its potential whenever a particular form of joint audit failed. In Denmark, the local audit firms essentially resisted attacks against the model rhetorically, which was insufficient to prevent its erosion in the 1990s and its suppression by the law in 2005. Contrasting the two cases shows the multi-modal ways in which actors undertake institutional work and it provides timely information for regulators engaged in discussions about joint audits.

Audit requirements and expectations, The good and better about MDSAP Regulations

The most sure-fire way to pass MDSAP audit with flying colours is to have an effective Quality Management System (QMS). Having a good QMS will make sure work is correctly documented, kept up to date, and easy to present to an auditor. For regulators too, it means a reduced burden. There is pooling of regulatory resources. The audits are conducted by Auditing Organizations designated by the regulatory bodies. The MDSAP program is expected to improve audit predictability because a standardized audit model has been introduced. Every audit follows the same set of steps. For the first time, a grading system is introduced for noncompliance. This approach helps reduce subjectivity. MDSAP has a very rigid auditing process to ensure the proper market authorizations have been obtained and facility registrations have occurred but not represent Marketing Authorization. Recently proposed greater alignment of FDA Quality System Regulation (QSR) with ISO 13485, would bring US QMS requirements for medical device manufacturers closer in line with quality system requirements in markets such as the European Union, Japan and Australia, potentially streamlining medical device registration and compliance processes across the US and other markets.

Financial Fraud Detection by Analyzing online Transaction

–Financial fraud is commonlyrepresented by the use of illegal practices wherethey can intervene from senior managers until payroll employees, becoming a crime punishable by law. There are many techniques developed to analyze, detect and prevent this behavior, being the most important the fraud triangle theory associated with the classic financial audit model. In order to perform this research, a survey of the related works in the existing literature was carried out, with the purpose of establishing our own framework. In this context, this paper presents Financial FraudDetection Scheme, a conceptual framework that allows to identify and outline a group of people inside an banking organization who commit fraud, supported by the fraud triangle theory. Financial Fraud Detection Scheme works in the approach of continuous audit that will be incharge of collecting information of agents installed in user’s equipment. It is based on semantic techniques applied through the collection of phrases typed by the users under study for later being transferred to ar epository for later analysis. This proposal encourages to contribute with the field of cybersecurity, in the reduction of cases of financial fraud. Index Terms- financial fraud, Cyber security, NTRODUCTION Fraud is a worldwide phenomenon that affects public and private organizations, covering a wide variety of illegal practices and acts that involve intentional deception ormisrepresentation. According to the Association of Certified Fraud Examiners(ACFE) [1] fraud includes any intentional or deliberate act of depriving another of property or money by cunning, deception or other unfairacts.

Brand auditing and the development of the brand salience management model of the Statistics Study Program

This research contains a novelty in producing a study program brand audit method and developing a brand salience development model in higher education, which has not been widely discussed. A quantitative-explanative research method was used in this study by collecting online survey data on the potential market for the Statistics Study Program with a total of around 1000 people from all over Indonesia, which is related to the understanding, association, perception, experience, brand equity, and consumer brand salience towards the Statistics Study Program. The data were analyzed using structural equation modeling (SEM). The results obtained are the formulation of a brand audit model and a salience brand management model for the Universitas Terbuka Statistics Study Program.

Predicting Mortality Following Traumatic Brain Injury or Subarachnoid Hemorrhage: An Analysis of the Validity of Standardized Mortality Ratios Obtained From the APACHE II and ICNARC H-2018 Models.

Standardized mortality ratios (SMRs), calculated using the Acute Physiology, Age, Chronic Health Evaluation II (APACHE II) and Intensive Care National Audit and Research Centre H-2018 (ICNARC H-2018 ) risk prediction models, are widely used in UK intensive care units (ICUs) to measure and compare the quality of critical care delivery. Both models incorporate an assumption of Glasgow Coma Score (GCS) if an actual GCS without sedation is not recordable in the first 24 hours after ICU admission. This study assesses the validity of the APACHE II and ICNARC H-2018 models to predict mortality in ICU patients with traumatic brain injury (TBI) or aneurysmal subarachnoid hemorrhage (aSAH) in whom GCS is related to outcomes. In a retrospective analysis, the SMR calculated by the APACHE II and ICNARC H-2018 models for all UK ICU admissions in a 1-year period was compared with calculated SMRs in TBI/aSAH patients and at 3 GCS groups. Data for patients admitted to a single tertiary neurocritical care unit were similarly analyzed. Both models predicted mortality well for the overall TBI/aSAH population; SMR (95% confidence interval) was 1.00 (0.96-1.04) and 0.99 (0.95-1.03) for the APACHE II and ICNARC H-2018 models, respectively. When analyzed by GCS grouping, both models underpredicted mortality in TBI/aSAH patients with GCS ≤8 (SMR, 1.1 [1.05-1.15]) and "unrecordable" GCS (SMR, 1.88 [1.77-1.99]). Similar findings were identified in the local data analysis. The APACHE II and ICNARC H-2018 models predicted mortality well for the overall TBI/aSAH ICU population but underpredicted mortality when GCS was ≤8 or "unrecordable." This raises questions about the accuracy of these risk prediction models in TBI/aSAH patients and their use to evaluate treatments and compare outcomes between centers.

Does environmental audit help to improve water quality? Evidence from the China National Environmental Monitoring Centre

As an essential re-supervision system of the environmental regulation, the environmental audit can help improve the quality of the ecological environment by correcting the deviation of local governments' environmental regulatory behavior. This study constructed a conceptual model of environmental audit affecting water quality, and empirically examined the effects and mechanism through the difference in difference (DID) regression and the mediating analysis. The panel data were collected from 76 cities covered by the surface water quality monitored by China Environmental Monitoring Station from 2006 to 2017. The results indicated that: (1) the overall effect of the environmental audit on the water quality was positive but not significant; (2) the environmental audit mainly encouraged local governments to strengthen superficial regulations with lower cost, more immediate and perceptible effects, but failed to promote the advanced regulation to reduce the pollution sources and fundamentally improve the water quality. On this basis, the policy implications were proposed that the environmental audit should be strengthened to further promote the advanced regulation and improve water quality constantly.

Blockchain assisted privacy-preserving public auditable model for cloud environment with efficient user revocation

Blockchain assisted privacy-preserving public auditable model for cloud environment with efficient user revocation

The use of data analytics in external auditing: a content analysis approach

PurposeThis study examines the perceptions of interested stakeholders on the factors affecting the use of data analytics (DA) in financial statement audits. Response letters submitted by stakeholders of the auditing services to the International Auditing and Assurance Standards Board's (IAASB) Data Analytics Working Group (DAWG) served as sources for analysis.Design/methodology/approachThe modified information technology audit model was used as a framework to perform a direct content analysis of all the 50 response letters submitted to the DAWG.FindingsThe analysis showed that a range of attributes, such as the usefulness of DA in auditing, authoritative guidance (auditing standards), data reliability and quality, auditors' skills, clients' factors and costs, were the factors perceived by stakeholders to be affecting the use of DA in external auditing.Research limitations/implicationsThis study is subjected to the limitations inherent to all content analysis studies. Nonetheless, the findings offer additional insights about potential factors affecting the adoption of DA in audit practices.Originality/valueThe data noted in the published statements highlighted the perceptions of a range of stakeholders with regards to the factors affecting the use of DA in auditing.

THE DEVELOPMENT OF A SCIENTIFIC THEORY OF AUDIT IS A REQUIREMENT OF TIME

Purpose. The aim of the article is to form a modern theoretical model (system) of auditing to improve the practical work of auditors. Methodology of research. The content of the article is based on the use of such a scientific apparatus as the historical method (when studying the process of the history of the emergence of audit needs), the monographic method and the method of historical development (based on the analysis of the formation of the modern theoretical audit model, the dialectic of changes in the audit environment and its formation on the basis of a set of philosophical , sociological, systemic, psychological and other approaches and methods of cognition), system and analytic – when processing the received information. Findings. The evolution of audit development is analysed depending on the accounting needs and production processes of the enterprise. It has been proven that an audit is a set of various empirical rules and procedures for the verification and assessment of the level of compliance of indicators of the desired and actual state of the object, for which individual persons are responsible. It was revealed that in connection with the changes in the accounting system, the conceptual basis of the audit should be clarified in terms of the theoretical base, organizational structure, and methodology of the study of the economic activity of the enterprise. Originality. The author substantiated the audit model, which can influence practical activity and determine its usefulness for business, which involves revealing the essence of audit, structure and axiology (values) for the economy of the country and enterprises. Practical value. The author’s proposals can be used as a methodical guideline for the implementation of the idea of practical use of audit in the organization of the internal control structure, which would guarantee the effective work of the company’s personnel at all stages of the technological process of production and its management. Key words: business, system, accounting, audit, model, auditor, paradigm.

AUDIT TATA KELOLA TEKNOLOGI INFORMASI COBIT 5 MANAJEMEN RISIKO

Conducting Information technology governance audits, which means conducting periodic checks on a system that has been built, now many audit models are emerging, but COBIT 5 is one of the relevant governance audits to use. The development of information systems goes hand in hand with the audit system, starting from reading a possible risk that will occur and preventing these risks, then in periodic checks can build a new innovation from the audit results itself, the lack of an information system is indeed a weakness of the system running, but with the evaluation, it means that the weaknesses of the system are minimized. This study discusses how to carry out risk management in an ongoing system with the APO12 domain on COBIT 5.

Innovative ecosystem: the role of lean management auditing

The auditing of organizations’ activities plays a crucial role in ensuring the direction chosen by top management and identifying early signs of upcoming changes and threats. The audit assesses the efficient use of resources and processes and promotes corporate credibility, which is essential from investors’ perspectives, particularly in ecosystems of innovations. Meanwhile, little is known about lean auditing, which is crucial in achieving effective processes. This paper summarises the arguments and counterarguments within the scientific discussion on the issue of auditing. The research’s primary purpose is to identify types of waste in auditing and formulate the principles of lean auditing. The systematic literature review and approaches for solving the problem based on grounded theory and triangulation of methods enabled the resolving of research problems. This article analyses the internal auditing standards and guidelines and uses in-depth interviews with 19 internal auditors from different Polish public organizations from 2017 to 2020. The choice of a qualitative approach resulted from the research phenomenon’s open nature, with very few studies. It created a need for a reflective approach with respondents simultaneously being key informants and experts. The results of an empirical analysis showed that internal auditors little knew about the lean concept in audit processes. However, they noticed the benefits of using the lean concept in the audit. The research enabled the development of the model of lean auditing. It could help improve the audit process, which is particularly important from the innovation ecosystem perspective. Besides, one determined the waste of auditing and formulated the principles of lean auditing. The research results develop the audit theory and are helpful for practitioners. Improved internal audit better meets stakeholders’ expectations regarding the spending of funds and implementation of tasks.

ИССЛЕДОВАНИЕ МЕТОДИК КОНТРОЛЯ УРОВНЯ ЗАЩИЩЕННОСТИ ИНФОРМАЦИИ НА ОБЪЕКТАХ КРИТИЧЕСКОЙ ИНФОРМАЦИОННОЙ ИНФРАСТРУКТУРЫ

Purpose of work is to analyze the existing practices of performing security analysis and IT-security audit (NIST, OWASP, Cobit, OSSTMM, PTES and GOST R ISO/IEC), used to obtain objective and reliable data for operational security assessments of the CII objects and development of an IT-security audit model for CII objects. Research method: methods of analysis and structural decomposition from the theory of system analysis, identifying signs essential for optimizing the process of IT-security audit for CII objects. Research result: include the detailed analysis and comparison of the existing best practices for performing security analysis and IT-security audit (NIST, OWASP, Cobit, OSSTMM, PTES and GOST R ISO/IEC) for CII objects. A model of IT-security audit for CII objects has been developed. Scientific novelty: an IT-security audit model for CII facilities, characterized by the possibility of a “dual” mode for a full cycle of ensuring the safety of CII facilities – a full national conditional mode and a combined conditional mode, which allows, if necessary, to include additional functional blocks

DomainPrio: Prioritizing Domain Name Investigations to Improve SOC Efficiency

Security Operations Centers (SOCs) are in need of automation for triaging alerts. Current approaches focus on analyzing and enriching individual alerts. We take a different approach and analyze the population of alerts. In an observational study over 24 weeks, we find a surprising pattern: some domains get analyzed again and again by different analysts, without coming to a final evaluation. Overall, 19% of the domains trigger 74% of all investigations. The most time-consuming domains are classified as false positives and “potentially unwanted programs”—the lowest threat level. To increase SOC efficiency, we design DomainPrio, a tool that prioritizes domains that are likely to be the subject of repeated, incomplete investigations. This enables us to indicate to the first analyst encountering this domain that the investigation should be, if possible, completed on this first attempt, so future investigations on the same domain can be prevented. DomainPrio is able to predict these domains with 89% accuracy and does so with an interpretable and auditable logistic regression model. When evaluating our tool on 100 days of data from a production setting, we find that it can potentially reduce the number of alert investigations by up to 35%, presenting the SOC with very substantial efficiency gains.

DS-Chain: A secure and auditable multi-cloud assisted EHR storage model on efficient deletable blockchain

In recent years, cloud storage service has widely attracted the healthcare industry. Healthcare organizations are gradually outsourcing the massive-scale electronic healthcare records (EHRs) on cloud paradigm. This specialized cloud-assisted EHR storage architecture facilitates the healthcare organizations with high scalability, flexibility, low-cost operations, and availability to outsourced EHRs. As EHR often contains patients’ sensitive medical information, it becomes essential to ensure the confidentiality and proper secrecy of the outsourced EHRs. Moreover, in the cloud-assisted EHR storage model, the patients no longer have direct control over their outsourced EHRs, which may also cause severe integrity and confidentiality related security issues. Presently, the healthcare industry observes that the emerging immutable blockchain technology properly attains the basic security needs for developing a secure cloud assisted EHR storage framework. Therefore, in this paper, we introduce a model named “DS-Chain”11A preliminary version of this paper was presented at the 22nd IEEE International Conference on High Performance Computing and Communications (IEEE HPCC - 2020).. - a novel deletable consortium blockchain based secure EHR storage model in a multi-cloud paradigm. The model’s key idea is to integrate each EHR outsourcing’s operations into a transaction on a novel efficient consortium blockchain. The proposed model ensures the confidentiality of the EHR’s sensitive medical information and guarantees the proper integrity and correctness of the outsourced EHRs. On the other hand, we employ the collaborative multi-cloud storage model that offers reasonable durability and availability for the outsourced EHRs in the cloud paradigm. Furthermore, we also arrange all the transactions according to their corresponding EHR’s type over the blockchain network, ensuring efficient block deletion. The detailed security analysis with proper formal proofs guarantees the computational intractability of the proposed model. Finally, the extensive performance analysis with test-simulations illustrates the feasibility and practicability of the proposed model.

A Cross Language Code Security Audit Framework Based on Normalized Representation

With the rapid development of information technology, audit objects and audit itself are more and more inseparable from software. As an important means of software security audit, code security audit will become an important aspect of future audit that cannot be ignored. However, the existing code security audit is mainly based on source code, which is difficult to meet the audit needs of more and more programming languages and binary commercial software. Based on the idea of normalized transformation, this paper constructs a cross language code security audit framework (CLCSA). CLCSA first uses compile/decompile technology to convert different high-level programming languages and binary codes into normalized representation, and then uses machine learning technology to build a cross language code security audit model based on normalized representation to evaluate code security and find out possible code security vulnerabilities. Finally, for the discovered vulnerabilities, the heuristic search strategy will be used to find the best repair scheme from the existing normalized representation sample library for automatic repair, which can improve the effectiveness of code security audit. CLCSA realizes the normalized code security audit of different types and levels of code, which provides a strong support for improving the breadth and depth of code security audit.

INTERNAL AUDIT OF SCHOOL ACTIVITIES AS A TOOL TO MANAGE THE QUALITY OF EDUCATION

The article is devoted to the topical issue of education management as an internal audit of the school and the technology of its implementation. Since the concept of "audit" appeared in the field of education in Ukraine recently, and tools to assess the educational activities of an educational institution is not enough, this issue requires careful study. The aim of the work is to theoretically justify the importance and organizational principles of internal audit as a tool for managing the quality of education, as well as to propose the use of factor-criteria model for such an assessment. In accordance with the goal, the following research methods were used: a) theoretical: analysis and systematization of philosophical, pedagogical, psychological and educational management literature to define organizational and pedagogical principles of quality of education and educational activities and conceptual and categorical apparatus of the study; modeling to develop a factor-criteria model as a technology for evaluating educational activities of general secondary education; content-analysis of legislative, regulatory and methodological documentation to clarify the parameters, factors, and criteria for evaluating educational activities; b) empirical: observations, questionnaires, interviews, the method of expert evaluations to assess the educational activities of institutions of general secondary education. The paper analyzes the scientific and pedagogical literature on the problem under study, which found that the problem of quality education for many centuries has been the subject of scientific discussions and searches of scientists: philosophers, economists, sociologists, educators. The study emphasizes that for a successful educational institution capable of providing a high level of quality education, it is essential to use tools and methods of quality assessment with clearly defined criteria, conducting an annual internal audit of its activities, which is seen as a process of data collection. Value/originality. The necessity and importance of internal audit of school activities were determined; internal audit tools using qualimetric approach to educational activities in institutions of general secondary education were developed; understanding of the main evaluation parameters (parameters of the educational environment, parameters of assessment of teaching activities, parameters of assessment of student activities, parameters of assessment of management processes) was enhanced. The technology of tools for quantitative measurement of the quality of education in institutions of general secondary education has been further developed. Practical implementation. Managers of institutions of general secondary education will be able to understand the importance and feasibility of internal assessment of the quality of education and use the factor-criteria model of the annual internal audit to ensure the continuous development of institutions of general secondary education and improve the level of educational services.

Exploring the role of industry 4.0 in enhancing supplier audit authenticity, efficacy, and cost effectiveness

Supplier audits are frequently criticized for lacking authenticity and objectivity. Technology-enhanced audits (TEA) offer a potential solution to supplier audit problems by enabling enhanced analytical, visualization, modeling, and predictive capabilities. This paper explores the potential of Industry 4.0 practices in enhancing supplier audit authenticity and efficacy, as well as reducing supplier monitoring costs. The application of Industry 4.0 in supplier auditing is still in its infancy. Therefore, this paper adopts an exploratory approach building on an extensive review of the literature. The paper builds upon an inductive-deductive approach to explore how the individual technologies underlying Industry 4.0 can be leveraged to enhance supplier audits. Based on insights from the literature, the paper develops propositions outlining the role of Industry 4.0 in supplier audit authenticity, efficacy, and cost-effectiveness. The paper builds arguments against the backdrop of traditional audits' limitations and illustrates how TEA can overcome many of these limitations. TEA can enhance the authenticity and efficacy of supplier audits, while also reducing supplier monitoring costs. TEA are most effective in an Industry 4.0 environment where the use of technologies is supported with governance structures. The application of Industry 4.0 can make supplier audits more transparent and value-adding, benefiting both the buyer and supplier. The theoretical and practical implications of the findings are explored. Suppliers can leverage TEA to create opportunities for strategic differentiation, enhance transparency and trust, and stand out from those who view audits solely as a cost. Buyers can use TEA to enhance audit efficacy, enhance insights into supplier operations, cut monitoring costs, and improve their competitiveness. TEA is a new generation of supplier auditing that has the potential to bring fundamental changes to current auditing models and make audits genuine, authentic, prospective, and insightful while building on Industry 4.0 principles.

The Implementation of the POPMAR (Policy, Organising, Planning and Implementing, Measuring Performance, Audit and Reviewing) Model in Occupational Health and Safety Risk Management in an Indonesian Batik Company

Introduction: In 2009, UNESCO declared Batik Indonesia as an Intangible Cultural Heritage of Humanity. This study examines the occupational health and safety hazards and risks that arise in a Batik company based on a case example of a Batik company in Surakarta, Indonesia. In Indonesia, Batik is categorized as traditional attire. Two kinds of Batik are produced - Batik tulis (traditionally handcrafted) and Batik printing, which uses specific printing tools. The UK Health Safety Executive (HSE) risk assessment framework is referred to in this study, which consists of: hazard identification, population exposure, risk evaluation, precaution development, recording findings, and regular appraisal of systems. Methods: Both observation and interviews (of workers) at the Batik company were utilized for this study as well as an independent risk assessment. Results: The findings highlighted physical, ergonomic, chemical, mechanical, and biological hazards, originating from the materials, tools, and working methods utilized in the batik production. Conclusion: Many of the issues highlighted by this study can be addressed via in-depth risk assessment, using the POPMAR model to frame the activities. This approach can create a positive pathway, leading to a continuous cycle of improvement which puts the workers’ health at the forefront of the business activities.Keywords: Batik, workers, hazard identification, HSE Model, risk management

Formulating a risk-based model of customer audit at a budgetary institution: Some special aspects

Subject. This article deals with the issues related to the development of internal control procedures defined on the basis of a risk-based approach in order to minimize risks in procurement activities and improve the effectiveness of the procurement department of a budgetary institution. Objectives. The article aims to study the issues of making a risk-based model of internal control of the customer, namely a budgetary institution, in the field of procurement. Methods. For the study, we used the methods of analysis, grouping, comparison, and generalization. Results. The article identifies certain factors constraining the effectiveness of internal control. It describes the risks faced by controllers when verifying the compliance of the customer's activities with the requirements of the Statutory regulations in force in the field of procurement of goods, works, and services. The article proposes a mechanism for the functioning of a risk-oriented model of internal control of the customer, namely a budgetary institution, and it describes the advantages and disadvantages of a risk-based control model. Conclusions. Despite the continuous process of improving the procurement of goods, works, and services, the violations detected by the supervisory authorities are still many. The development and use of a risk-based customer-audit model is an important step towards improving the efficiency of the budget institution.