Informatica Economic? vol. 14, no. 1/2010 57Changing Methodologies in Financial Audit and Their Impacton Information Systems AuditDaniel VÎLS?NOIU, Mihaela ?ERBANDoctoral School Accounting and Management Information SystemsAcademy of Economic Studies, Bucharest, [email protected], [email protected] paper tries to provide a better understanding of the relation between financial audit andinformation systems audit and to assess the influence the change in financial audit methodologies had on IS audit. We concluded that the COSO Internal Control Integrated Frameworkwas the starting point for fundamental changes in both financial and IS audit and that theSarbanes-Oxley Act should be viewed as an enabler rather than an enforcer in establishingstrong governance models. Finally, our research suggests that there is a direct causality effect between the employment of BRA (business risk audit) methodologies and the growing importance of IS audit.Keywords: Financial Audit Methodologies, Business Risk Audit, Information Systems Audit,Internal Controls FrameworkIntroductionThe objective of this article is to provide abetter understanding of the relation between financial audit and information systems audit andto assess the influence the change in financial audit methodologies had on IS audit.In order to achieve our objective, we reviewedexisting research from both academics and professionals regarding financial and informationsystems audit methodologies. We also obtainedand reviewed materials from leading professionalorganizations in financial and information systems auditing, such as the International Auditingand Assurance Standards Board (IAASB), theAmerican Institute of Certified Public Accountants (AICPA), the Information Systems Auditand Control Association (ISACA) and the ITGovernance Institute (ITGI).According to [1], the purpose of a financial auditis to enhance the degree of confidence of intended users in the financial statements. This isachieved by the expression of an opinion by theauditor on whether the financial statements areprepared, in all material respects, in accordancewith an applicable financial reporting framework.In [2], the information systems audit is defined asthe process of collecting and evaluating evidencein order to determine whether the informationsystems and related resources adequately safeguard assets, mentain data and system integrityand availability, provide relevant and reliable information, achieve organizational goals effectively, consume resources efficiently, and have, in effect, internal controls that provide reasonable assurance that business, operational and control objectives will be met and that undesired eventswill be prevented or detected and corrected in atimely manner.We begin by noticing that starting from the mid1990s, a change in financial audit methodologiesoccurred. This change was characterized by shifting the focus of auditors from financial statementrisk to business risk and by the employment ofnew types of audit procedures such as testing supervisory controls and high precision analyticalwork.We continue by summarizing the features of theold and the new audit methodologies andwith an analysis of what caused this shift andwhat are the main advantages and disadvantagesof the new audit methodology.In the 3rd chapter we focus on how laws and regulations that were initially addressed to financialauditors influenced information systems auditingand in the 4th chapter we link the evolution of theIS audit profession with the adoption of new financial audit methodologies, which allowed therapid growth of revenues generated from nonaudit services for large audit firms.We finish by presenting our conclusions and byproposing some possible areas of research.2 Transaction cycle vs. Business process auditmethodologiesAfter reviewing prior research about audit methodologies and technological changes in financial audit practices, it became apparent to us thatall authors agree that in the 1990s there has been158 Informatica Economic? vol. 14, no. 1/2010a shift in methodologies applied by financial audit professionals. While there are differences interminologies between authors and there is somedebate about when the change has occurred andwhat caused it, all of them recognize the existence of an old and a new audit paradigm.All citied papers state the old audit methodologies are transaction cycle oriented and the newmethodologies are business process oriented. According to [3], the change in the audit approachwas achieved by:? focusing the audit to business risk rather thanfinancial statement risk? changing the nature of audit work from substantive procedures (i.e. large volume tests ofdetails) to the testing of supervisory controls,supported by high precision analytical workThe main differences between these financial audit paradigms are summarized in Table 1.Table 1. Comparison of traditional and new business risk paradigms [4] Transaction cycle oriented audit approachBusiness process oriented audit approachRisk assessment occurs periodicallyRisk assessment is a continuous processAccounting, Treasury and Internal Audit responsiblefor identifying risks and managing controlsBusiness risk identification and control managementare the responsibility of all members of the organizationFragmentation every function behaves independentlyConcentration Business risk assessment and control are focused and coordinated with senior leveloversightControl is focused on financial risk avoidanceControl is focused in the avoidance of unacceptablebusiness risk, followed closely by management ofother unavoidable business risks to reduce them toan acceptable levelBusiness risk controls policies, if established, generally do not have the full support of upper management or are inadequately communicated throughoutthe companyA formal business risk controls policy is approvedby management and board and communicatedthroughout the companyInspect and detect business risk, then react to thesourceAnticipate and prevent business risk and monitorbusiness risk controls continuouslyIneffective people are the primary source of businessriskIneffective processes are the primary source of business risk 2.1 Transaction cycle oriented auditTransaction cycle oriented methodologies orTFAs (transaction-focused approaches), as theyare referred to in [5], are highly structured topdown approaches of the audit process which constrain the range of actions available to individualauditors in specific circumstances and are characterized by rigid decision making processes [6].These methodologies do not require the auditor togain a deep understanding of the auditees business strategy (and resulting business risk) as thisinformation is used only in the pre-audit or planning activities and no implications of the business risks are considered when determining auditrisk [7]. At best, auditors are required to concentrate their attention to account-level factors before considering the influence of business riskfactors. [5]The main objective of transaction cycle orientedaudit methodologies is to reduce the risk of auditors making judgmental errors and provide for arationale for issuing audit opinions which isstrong enough to withstand reviews from peerauditors or regulators. In order to achieve this objective, a range of tools and techniques was developed or refined so that it would meet the required level of assurance for issuing audit opinions (e.g. statistical sampling, risk based testing,analytical procedures, decision aids and goingconcern evaluation) [6].2.2 Business process oriented auditIn [8] paragraph 4-b, business risk is defined asthe risk resulting from significant conditions,events, circumstances, actions or inactions thatcould adversely affect an entitys ability toachieve its objectives and execute its strategies,or from the setting of inappropriate objectivesand strategies.The idea that anything that increased businessrisk also increased audit risk [9] first emerged inthe mid 1990s and eventually led to a shift in audit methodologies. Arguing that anything thathad the potential to increase the risk that an organization would not meet its objectives is asource of increased audit risk or simply busiInformatica Economic? vol. 14, no. 1/2010 59ness risk drives audit risk [6], members of theacademic and audit community developed new,business process oriented, audit methodologiesthat were commonly referred to as BRA (Business Risk Auditing) or Strategic Systems Auditing (SSA) [10].Some authors claim that broadening perceptionsin risk such as enunciated in the Committee ofSponsoring Organizations for the TreadwayCommission (COSO) report, Internal Control Integrated Framework (1992) paved the way forthe new BRA methodologies emergence. [6]The standard scenario for using these methodologies is [4]:1. Modeling business risk processes of theclient company.2. Mapping the clients strategy to the relatedbusiness risks.3. Using the knowledge about the clients business risks as the basis for determining auditrisks.4. Perform audit tests according to the identifiedaudit risks.A key benefit that led to the development and useof BRA methodologies by financial auditors wasthe greater added value that could be provided tothe client. A better understanding of the clientsbusiness strategy would presumably allow auditors not only to better evaluate audit risks but also to identify other potential risks or areas of improvement for the client. It was claimed that byemploying BRA methodologies, auditors couldcomment on business risks and also on their impact over financial statements [4].In other words, by performing a comprehensivereview of all business risks during the process ofidentifying audit risks, a so called knowledgespillover [4] from the audit would be generated.This would result in extra feedback provided tothe client which would get more information forhis money.In order to better evaluate risks, auditors analyzevariations in metrics that provide key performance indicators (KPIs) for business processesand then integrate their knowledge of businessrisks with evidence about changes in accountingmetrics [5].2.3 Causes of the changeThe most commonly cited causes for the shift inaudit methodologies are:? Large audit firms (formally known as theBig8, Big6, Big5 and nowadays Big4) enforced BRA methodologies in their attemptto increase their revenues by widening theirarea of expertise from audit to consultingservices. [6], [4]? Poor regulation of audit markets allowedlarge audit firms to pursue revenue growth byproviding consulting services [6]? Changes in technology increased the likelihood of financial misstatements so auditorslooked for methods of incorporating businessrisk more directly in their audit risk assessment in order to respond to their clients needfor assurance. [4] [5]? The growth in internal audit services withinclient companies led to pressures on auditorsto reduce fees on the claim that part of the assurance was provided by the internal auditfunction [6]? Although cost cutting has always been an objective of the audit firms, using BRA methodologies allowed auditors to achieve this goalby using less resource consuming substantiveprocedures [4] [7]2.4 Discussion: pros and cons of the businessprocess oriented auditWe noticed that although authors agree on theshift in audit methodologies, there is a debateabout how beneficial was the change for the auditprofession.Supporters of the BRA methodologies claim thatauditors who use them are more likely to integrate evidence about business risk directly intotheir planning judgments about the risk of material misstatement [5] [11], because of the wayinformation about business risks and their impacton audit risk is structured in the BRA approach.In [1] paragraph 13-n, the risk of material misstatement (RMM) is defined as the risk that the financial statements are materially misstated priorto audit. This consists of two components, described as follows: Inherent risk The susceptibility of anassertion about a class of transaction, accountbalance or disclosure to a misstatement that couldbe material, either individually or when aggregated with other misstatements, before consideration of any related controls. Control risk The risk that a misstatement that could occur in an assertion about aclass of transaction, account balance or disclosureand that could be material, either individually orwhen aggregated with other misstatements, willnot be prevented, or detected and corrected, on atimely basis by the entitys internal control.Furthermore, BRA methodologies are analyzedand recommended as a response to changes in the60 Informatica Economic? vol. 14, no. 1/2010audit environment and to the stakeholders growing demand for protection against financialstatements fraud.According to [7], auditors who use the SSA approach must build their assurance that managements financial statements present a true and fairview of the audited entity by having a clear understanding of the entitys business strategies,conditions, processes, and economic actions/events, as well as past, current, and likelyfuture business relationships with other entities.Critics of BRA methodologies claimed that auditors (especially large audit firms) used them toopen the possibility for more lucrative non-audit(consulting) services that could be provided toclients following a complete business risk evaluation [6].They also claimed that these methodologiesfailed to prevent or even warn the public aboutmajor financial collapses of companies (e.g..Enron) or on the financial crisis which began in2007. In [12], it was noted that many financial institutions which sought state support were givenunqualified audit opinions by large audit firms(mainly Big4 companies) shortly before their collapse. Questions were raised about auditors independence (all of the auditors collected largeamounts of audit and non-audit fees from theirclients) and quality of work (the BRA methodology was being put under scrutiny).Another shortcoming of the BRA methodologiesis that even experienced auditors find it difficultto link business risks and related controls with financial statement amounts. While in theory itwas generally accepted that business risk is related to audit risk, practitioners were uncomfortable with this inference in auditing (giving an audit opinion on the financial statements based onindirect evidence drawn from analysis concerningbusiness risks and the operation of high levelcontrols) [3] [9].This is why regulatory initiatives that followedfrom the aftermath of Enron, tried to bridge thisgap by reconsidering business risk audit methodsin the form of combining the best from transaction focused audits with the best from businessrisk auditing [6]. This goal was achieved by auditpractitioners by performing more substantive audit procedures [3].The debate about BRA methodologies is likely tocontinue in the following years, with some authors calling for more research on how to organize business process information for auditor usein audit risk assessment [13] and for more research into the efficacy of the risk-based auditapproach that is now embodied in professionalstandards [5].3 The impact of financial audit regulations oninformation systems auditingIn this chapter we consider the way laws and regulations that were initially addressed to financialauditors influenced information systems auditing.We focused on the Sarbanes-Oxley Act of 2002which requires organizations to select and implement a suitable internal control frameworkand on the COSO Internal Control IntegratedFramework which has become the most commonly adopted framework by public companiesseeking to comply with the new regulations [2].3.1 The COSO Internal Control IntegratedFrameworkIn 1992 COSO published what now is referred toas the COSO Model of Internal Control (Figure1) and when AICPA adopted the COSO Model asStatement on Auditing Standard (SAS) No. 78,Consideration of Internal Control in a FinancialStatement Audit it became a part of the technical literature for financial auditors. [14]Although audit professionals were very well familiarized with the concept of risk, the COSOModel of Internal Control caused the challengingof conventional (transaction cycle oriented) auditapproaches inside the audit prof
ession and eventually led to the development of business riskaudit methodologies [6].Also, the COSO model emphasized the conceptsof risk and risk management to audit professionals, by identifying new dimensions of internalcontrols that were relevant to the conduct of anaudit [6]. There were five dimensions that weredepicted in the COSO internal control cube(figure 1):? control environment (the circumstances of theclient)? risk assessment (the ability to identify threats)? control activities (the actions taken to intervene)? monitoring (the maintenance of controls),? information and communication (the ability tocoordinate all dimensions)Informatica Economic? vol. 14, no. 1/2010 61Fig. 1. The COSO internal control cube [15]Because most of the internal controls that wererelevant to financial audit were relying on IT, anincreasing demands that IS auditors provide assurance regarding the IT based controls emerged.This is whyThe internal controls dimensions, which are usedby financial and IS auditors in performing theirwork, can be detailed as follows [14]:The control environment element is a view of internal controls from the entitys perspective.Some of the ways the risks associated with thecontrol environment can be evaluated include:? Communication and enforcement of integrityand ethical values;? Commitment to competence;? Participation of those charged with governance;? Managements philosophy and style;? Organizational structure;? Assignment of authority and responsibility;? Human resource policies and practices;? Industry factors.The risk assessment aspect of COSO, refers tothe entitys ability to properly assess risks and,for major (significant) risks, mitigate them toan acceptable level using controls. Areas wherecontrols and/or procedures should be developedto enhance the entitys system of controls include:? Changes in operating environment;? New personnel;? New or revamped information systems;? Rapid growth;? New information technology employed;? New business models, products or activities;? Corporate restructurings;? Expanded foreign operations;? New accounting pronouncements.Controls are evaluated at three levels: design effectiveness, implementation and operational effectiveness and some of the various ways to evaluate control activities include:? General controls: Policies and procedures related to the service/product provided; Controls over support (especially computersystems and operations, networks, etc.); Changes to systems associated with corebusiness processes; Environmental security; Application development, maintenance anddocumentation; Information security; Disaster recovery/business recovery;? Application controls: Tests of control; Controls embedded in various applicationsto satisfy managements policies and procedures for carrying out businessprocesses.? Physical controls: Authorization of service instance; Segregation of duties (if applicable, ITpersonnel too); Supervision; Audit trails; Access controls to systems and data; Independent verification (performance re62 Informatica Economic? vol. 14, no. 1/2010ports, independent reviews, audits, errorlogs, etc.).The information and communication element ofthe COSO model requires that financial reportinginformation should have reliability and should becommunicated in a timely and accurate manner tomanagers and decision makers.Information and communication risks can be evaluated include:? Systems to support the identification, captureand exchange of information in a form andtime frame that enable personnel to carry outtheir responsibilities;? Financial reporting information;? Internal control information;? Internal communication;? External communication.Monitoring refers to the entitys ability to monitor the effectiveness of controls as they operatedaily, individually and in cooperation with othercontrols. Some of the various ways in which controls over monitoring of control effectiveness canbe evaluated regarding the risks associated withthose activities include:? Ongoing and separate evaluations on internalcontrols over financial reporting;? Identifying and reporting deficiencies;? Assessing the quality of internal control performance over time;? Putting procedures in place to modify the control system as needed (add, change, delete);? Ensuring effective management review ofcontrol system status;? Checking for the absence of monitoring systems, which tends to allow people to reducevigilance on controls;? Utilizing relevant external information or independent monitors;? Analyzing control objectives and their relatedcontrol activities;? Reviewing changes to controls since the dateof the last report or within the last 12 months.3.2 The Sarbanes-Oxley ActAnother regulation that had a major impact on information systems audit was US Sarbanes-OxleyAct of 2002 (or SOX). Section 404 of SarbanesOxley requires management to do an evaluationof internal controls and financial auditors toopine on that evaluation. In addition, the Actcreated the Public Company Accounting Oversight Board (PCAOB) as an agency to provideoversight of financial reporting for publiclytraded companies and report to the US Securitiesand Exchange Commission (SEC) [16].The act was aimed primarily at public companiesboards, management and audit firms by prohibiting registered public accounting firms from performing certain non-audit services for a publiccompany client for whom it performs financialstatement audits. Such prohibited non-audit services include internal audit outsourcing servicesand financial information system design and implementation [4].Sarbanes-Oxley experts agreed that IT controlwas a specific area likely to produce significantdeficiencies by many companies. As the majorityof internal controls are embedded in automatedsystems, IS auditors have become a vital part ofcomplying with the standards, guidelines andregulations [17].This is why IT professional organizations, suchas the IT Governance Institute (ITGI), tried tostandardize a set of objective and responsibilitiesfor IT departments of audited companies in orderto comply to the Sarbanes-Oxley Act.The following section provides a complianceroad map that is tailored to the specific objectivesand responsibilities of IT departments [18]:1. Plan and scope IT controls: Assign Accountability and Responsibility; Inventory Relevant Applications and Related Subsystems; Review Financial Process Documentationand Identify Application Controls; Develop a Preliminary Project Plan andObtain Approval; Determine Responsibility for ApplicationControls; Consider Multilocation Issues; Consider Whether Applications Can BeEliminated From Scope; Identify Dependencies on Third-party Service Organizations (Outsourcing).2. Assess IT risk: Assess the Inherent Risk of Applicationsand Related Subsystems; Refine Scope and Update the Project Plan.3. Document controls Identify IT Entity-level Controls; Identify Application Controls; Identify IT General Controls; Identify Which Controls Are RelevantControls; Consider IT-based Antifraud Controls; Control Documentation.4. Evaluate control design and operating effectiveness Evaluate Control Design; Evaluate Operational Effectiveness;Informatica Economic? vol. 14, no. 1/2010 63 Consider the Nature of Evidence Required; Consider the Timing of Control Testing; Roll-forward Testing.5. Prioritize and remediate deficiencies Consider Guidance From the SEC andPCAOB; Identify and Assess IT General ControlDeficiencies; Consider the Aggregate Effect of Deficiencies; Remediate Control Deficiencies.6. Build sustainability Rationalize Controls; Automate Controls; Perform Application Benchmarking.In [18], ITGI recommends that the work performed to meet the requirements of the SarbanesOxley Act should not be regarded as a compliance process, but rather as an opportunity toestablish strong governance models designed toresult in accountability and responsiveness tobusiness requirements. Building a strong internalcontrol program within IT can help to:? Gain competitive advantage through more efficient and effective operations;? Enhance risk management competencies andprioritization of initiatives;? Enhance overall IT governance;? Enhance the understanding of IT among executives;? Optimize operations with an integrated approach to security, availability and processingintegrity;? Enable better business decisions by providinghigher-quality, more timely information;? Contribute to the compliance of other regulatory requirements, such as privacy;? Align project initiatives with business requirements;? Prevent loss of intellectual assets and the possibility of system breach.4 The evolution of the IS auditor profession inthe context of changing audit methodologiesIn this chapter we present a history of the IS auditor profession and how the status of IS auditorsevolved in large financial audit firms. We also tryto link this evolution to changes in financial auditmethodologies, as presented in chapter 2 of thisarticle.In [19], the role of information systems auditorsin large financial audit firms is examined. The results can be summarized as follows:Prior to 1990 (financial audit methods weretransaction cycle oriented and IS audit was seenas a secondary function to financial audit):? Most IS auditors were financial auditors withsome interest in information systems andmany of them fulfilled both roles;? Firms hired experienced IS professionalswhen special technology skills were neededfor financial audit;? IS audit was not seen as an added value factorto the audit from either the clients or the financial auditors perspective;? The relationship between financial and IS audit was seen as symbiotic (at least theoretically);? Financial auditors had little understanding ofthe work done by IS auditors and were notconfident enough of the IS audit risk assessment to consider it into their audit planning;? IS auditors did not always understand the implications of control weaknesses on financialstatements;? 1990-1995 (BRA methodologies were beginning to be applied by financial audit professionals and new opportunities for selling nonaudit services by audit firms arose);? The emergence and growth of the IS auditpractice large audit firms compelled them tohire IS auditors directly;? IS audit began to achieve some independenceas a specialty group that provided certain value-added client services, but still largely supported financial audit;? IS audit began to shift towards the testing ofapplication controls instead of focusing primarily on an assessment of general controls;? The firms were beginning to move to automated work papers and were starting to buildbest practices databases;? Financial auditors did not see how a weaknessin general controls, such as a poor programchange control process, affected the financialstatements;? IS auditors were not always able to communicate this impact effectively either, but felt thatsuch a weakness was problematic. As auditsshifted more towards a risk-based approach,this understanding gap narrowed;? 1995-2000 (IS auditors performed manly nonaudit services);? The move toward expanding IS audit serviceshas continued to the extent that financial auditsupport was less than half of the work done byIS auditors;? IS auditors were offering a variety of consulting services (e.g. penetration testing, firewallaudits, security diagnostics, system effective64 Informatica Economic? vol. 14, no. 1/2010ness, technology assurance, ERP related workand business continuity planning);? To support the financial audit, general controlevaluation work was still being done. However, this work was undertaken only after a riskassessment was made that identified the impact control weaknesses were likely to haveon both the clients financial statements andon the overall business.The increasing importance of non-audit services(including IS audit) is confirmed by the evolutionof their weight in the overall revenues of largeaudit firms (Table 2).Table 2. FTSE top 100 companies: ratios of audit to non-audit fees earned by the Big (6/5/4/) AuditFirms 19922001 [4] YearRatio of non-auditfees : audit feesAudit fees (%)Non-audit fees (%)Total fees (%)19920.2:1811910019930.6:1633710019940.6:1623810019950.6:1623810019960.9:1514910019971.3:1445610019981.5:1396110019992.3:1307010020002.9:1267410020013.7:12179100 5 ConclusionsAccording to our research, although authorsagree on the shift in audit methodologies, fromtransaction cycle oriented (TFAs) to businessprocess oriented (BRA or SSA), there is still adebate about how beneficial was the change forthe audit profession. In our opinion, this debateoffers some interesting possibilities of research,as the efficacy of the BRA methodology is yet tobe undoubtedly proven.We concluded that the COSO Internal Control Integrated Framework was the starting point forfundamental changes in both financial and IS audit. Besides being the most commonly adoptedframework by public companies seeking tocomply with the Sarbanes-Oxley regulations, italso led to the development of business risk audit methodologies, which in turn opened up thepossibility for IS auditors from large audit firmsto provide an extended array of IT consultingservices.We also found that the Sarbanes-Oxley Act had abig impact on IS auditing by imposing stricterregulations regarding internal controls and in ouropinion, the SOX regulations should be viewedas an enabler rather than an enforcer in establishing strong governance models.Finally, our research suggests that there is a direct causality effect between the employment ofBRA audit methodologies and the growing importance of IS audit. We propose analyzing theinfluence of other factors, such as evolutions intechnology and changes in the business environment to the IS audit as a research theme.References[1] International Auditing and Assurance Standards Board (IAASB), International Standard on Auditing 200. Overall Objectives ofthe Independent Auditor and the Conduct ofan Audit in Accordance with InternationalStandards on Auditing, New York, 2009.[2] ISACA, CISA Review Manual 2009, 2008,pp. 15-34.[3] E. Curtis and S. Turley, The business riskaudit A longitudinal case study of an auditengagement, Accounting, Organizationsand Society, No. 32, 2007, pp. 439461.[4] K. Robson, C. Humphrey, R. Khalifa and J.Jones, Transforming audit technologies:Business risk audit methodologies and theaudit field, Accounting, Organizations andSociety, No. 32, 2007, pp. 409438.[5] J. J. Schultz Jr., J. L. Bierstaker and E.ODonnell, Integrating business risk intoauditor judgment about the risk of materialmisstatement: The influence of a strategicsystems-audit approach, Accounting, Organizations and Society, 2009,doi:10.1016/j.aos.2009.07.006.[6] W. R. Knechel, The business risk audit: Origins, obstacles and opportunities, Accounting, Organizations and Society, No. 32,2007, pp. 383408.Informatica Economic? vol. 14, no. 1/2010 65[7] M. E. Peecher, R. Schwartz and I. Solomon,Its all about audit quality: Perspectives onstrategic-systems auditing, Accounting, Organizations and Society, No. 32, 2007, pp.463485.[8] International Auditing and Assurance Standards Board (IAASB), International Standard on Auditing 315. Identifying and Assessing the Risks of Material Misstatementthrough Understanding the Entity and ItsEnvironment, 2009, New York.[9] C. Flint, I. A. M. Fraser and D. J. Hatherly,Business risk auditing: A regressive evolution? A research note, Accounting Forum,No. 32, 2008, pp. 143147.[10] W. R. Knechel, S. E. Salterio and N. Kochetova-Kozloski, The effect of benchmarkedperformance measures and strategic analysison auditors risk assessments and mentalmodels, Accounting, Organizations andSociety, 2009,doi:10.1016/j.aos.2009.09.004.[11] C. Dowling and S. Leech, Audit supportsystems and decision aids: Current practiceand opportunities for future research, International Journal of Accounting InformationSystems, Vol. 8, 2007, pp. 92116.[12] P. Sikka, Financial crisis and the silence ofthe auditors, Accounting, Organizationsand Society, No. 34, 2009, pp. 868873.[13] C. Carnaghan, Business process modelingapproaches in the context of process levelaudit risk assessment: An analysis and comparison, International Journal of Accounting Information Systems, Vol. 7,