A Model for Combining Risk Information Systems with Audit Expert Systems

该研究项目涉及开发一个将风险信息系统与审计专家系统相结合的模型。该模型的目的是从系统论的角度为以下两个方面提供理论基础：（1）风险管理过程审计，特别是风险衍生（一种风险引起另一种风险的过程）-一个新兴的研究领域;（2）发展基于风险的审计战略和选择及应用审计程序的方法-一个较成熟的研究领域。(1)简单的线性关联模型（风险→控制目标→控制活动）在建模风险信息管理过程中的作用有限;相反，我们使用一个“交互模型”，该模型以坚实的结构关系来表达与管理活动背后的每个结构要素相关的风险。交互模型定义了核心业务流程风险与战略管理规划、组织结构、信息技术基础设施和员工技能相关风险之间的相互关系。(2)系统化地使用映射技术为风险信息分析提供了一种有效的手段。当一项具体的控制活动对某一特定风险采取行动时，其结果要么是减少该风险对公司活动的影响，要么是减少该风险发生的可能性。该模型以这种方式建立了风险类别和控制活动的数据库。(3)风险控制自我评估，通过研讨会，汇集了来自所有部门的管理人员，是一个有效的手段，积累风险信息。它还有一个优点，就是能够及时反馈风险因素的波动情况。

The research project involved development of a model combining risk information systems with audit expert systems. The model aims to provide a theoretical basis from a systems theory perspective for :(1) risk management process auditing, particularly with respect to risk derivation (the process by which one type of risk gives rise to another) - an emerging research field ; and(2) the methodology of developing risk-based audit strategies and selecting and applying audit procedures a more established research field.The three defining characteristics of the conceptual model are as follows.(1) The simple linear association model (risk → control objectives → control activities) is of limited use for modeling risk information management processes ; instead, we use an "interaction model" that expresses the risk associated with each of the structural elements behind management activities in solid structural Rerms. The interaction model defines the correlations between core business process risks and risks associated with strategic management planning, organizational structure, information technology infrastructure, and employee skills.(2) Using mapping techniques in systemized form provides an effective means of analyzing risk information. When a specific control activity acts on a given risk, the result is either a reduction in the impact of the risk on corporate activity or a reduction in the likelihood of the risk occurring in the first place. The model builds up a database of risk categories and control activities in this way.(3) Risk control self assessment, through workshops that bring together managers from all departments, is an effective means of accumulating risk information. It also has the advantage of providing timely feedback on fluctuations in risk factors.