A Model for Combining Risk Information Systems with Audit Expert Systems

该研究项目涉及风险信息系统与审计专家系统相结合的模型开发。该模型旨在从系统理论的角度为以下方面提供理论基础：(1)风险管理过程审计，特别是风险衍生（一种风险引发另一种风险的过程）——一个新兴的研究领域；(2)制定基于风险的审计策略以及选择和应用审计程序的方法论是一个较为成熟的研究领域。概念模型的三个定义特征如下。(1)简单的线性关联模型（风险→控制目标→控制活动）对风险信息管理过程建模的作用有限；相反，我们使用一个“交互模型”来表达在坚实的结构模型中管理活动背后的每个结构元素所关联的风险。交互模型定义了核心业务流程风险与与战略管理计划、组织结构、信息技术基础设施和员工技能相关的风险之间的相关性。(2)采用系统化的制图技术提供了分析风险信息的有效手段。当特定的控制活动作用于给定的风险时，其结果要么是降低风险对公司活动的影响，要么是降低风险首先发生的可能性。该模型以这种方式建立了风险类别和控制活动的数据库。(3)风险控制自我评估，通过各部门管理人员参加的研讨会，是积累风险信息的有效手段。它还具有就风险因素的波动提供及时反馈的优点。

The research project involved development of a model combining risk information systems with audit expert systems. The model aims to provide a theoretical basis from a systems theory perspective for :(1) risk management process auditing, particularly with respect to risk derivation (the process by which one type of risk gives rise to another) - an emerging research field ; and(2) the methodology of developing risk-based audit strategies and selecting and applying audit procedures a more established research field.The three defining characteristics of the conceptual model are as follows.(1) The simple linear association model (risk → control objectives → control activities) is of limited use for modeling risk information management processes ; instead, we use an "interaction model" that expresses the risk associated with each of the structural elements behind management activities in solid structural Rerms. The interaction model defines the correlations between core business process risks and risks associated with strategic management planning, organizational structure, information technology infrastructure, and employee skills.(2) Using mapping techniques in systemized form provides an effective means of analyzing risk information. When a specific control activity acts on a given risk, the result is either a reduction in the impact of the risk on corporate activity or a reduction in the likelihood of the risk occurring in the first place. The model builds up a database of risk categories and control activities in this way.(3) Risk control self assessment, through workshops that bring together managers from all departments, is an effective means of accumulating risk information. It also has the advantage of providing timely feedback on fluctuations in risk factors.