Identifying the Absence of Effective Internal Controls: An Alternative Approach for Internal Control Audits

ABSTRACT Auditors face new challenges when auditing internal controls due to the increasing integration of information systems for transaction processing and the growing amount of data. Traditional manual control testing procedures become inefficient or require highly specialized and scarce technical knowledge. This study presents audit procedures that follow a new approach. Instead of manually testing internal controls, automated procedures search for the absence of those controls. Process mining techniques are combined with advanced statistical analysis where process mining serves as a data analysis technique to create process models from the recorded transaction data. These are searched for critical data constellations in combination with an exploratory factor analysis to identify systematic deficiencies in the internal control system. The manual and time-intensive inspection of individual controls is replaced by automated audit procedures that cover the totality of recorded transactions. The study follows a design science approach and uses case study data for illustration.