Audit of Financial Information Systems: a risk-based approach and fuzzy logic

Abstract

Nowadays, business is exposed to information system risks and threats. This justifies the growing inquiry, of investors and shareholders, on their business security. Information systems auditing has strong tools and techniques, which can assist organizations in minimizing these risks and threats. But the fast-changing and growth of information systems makes the audit missions more complex and surrounded by uncertainty, related to audit quality parameters like experience, knowledge, and others. In line with this, the auditors may be faced with discrepancies during auditing, with each anomaly typically triggering a binary evaluation of significance. In this paper, we develop a fuzzy expert system framework, which evaluates the level of significance in the audit by allowing a discrepancy to have a level between 0 and 1. Such a framework enables the auditor to have increased accuracy and more flexibility in evaluating the appropriate level of significance, and provides a better understanding of the scope of subsequent audits and examinations. As results, we show that a fuzzy expert system has the potential to assist the auditor in the process of including qualitative information in the frivolous level and identifying the anomalies that may be most worthy of investigation. The fuzzy expert system standardizes the process of auditing by providing a formal model structure. This may facilitate reporting within the audit organization and improve the coherence of the audit process between auditors, missions over time.

JEL Classification: C67, M15, M42

Paper type: Empirical research