نوع مقاله : مقاله پژوهشی

نویسندگان

• مجتبی احمدی ¹
• علیرضا پورابراهیمی ²
• لادن ریاضی ³
• سیدعبداله امین موسوی ⁴

¹ دانشجوی دکتری رشته مدیریت فناوری اطلاعات، گروه مدیریت فناوری اطلاعات، دانشکده مدیریت و اقتصاد، واحد علوم و تحقیقات، دانشگاه آزاد

² استادیار گروه مدیریت صنعتی، دانشکده مدیریت و حسابداری، واحد کرج، دانشگاه آزاد اسلامی، کرج، ایران نویسنده مسئول : poorebrahimi@gmail.com

³ استادیار گروه مدیریت فناوری اطلاعات، دانشکده مدیریت و اقتصاد، واحد علوم و تحقیقات، دانشگاه آزاد اسلامی، تهران، ایران

⁴ استادیار گروه مدیریت صنعتی، دانشکده مدیریت، واحد تهران مرکزی، دانشگاه آزاد اسلامی، تهران، ایران

چکیده

در این مقاله، چالش‌های اجرای فرآیند حسابرسی فناوری اطلاعات در شبکه بانکی ایران از طریق انجام یک مطالعه موردی در چهار بانک بزرگ ایرانی شناسایی شده‌است. داده‌ها از طریق انجام 20 مصاحبه با خبرگان هر دو حوزه مدیریت فناوری‌اطلاعات و حسابرسی فناوری اطلاعات مؤسسات اعتباری مزبور، و بررسی برخی از اسناد داخلی آنها جمع‌آوری شده‌است. در این پژوهش 20 مورد از چالش‌ها و مشکلات اصلی اجرای فرآیند حسابرسی فناوری اطلاعات شناسایی شد. یافته‌های پژوهش نشان داد که "عدم استقلال و وجود منافع مالی مشترک"، "ناتوانی برقراری ارتباط میان واحد حسابرسی فناوری ‌اطلاعات و واحد فناوری اطلاعات"، "سازمان و ساختار اداری نامناسب نهاد تحت حسابرسی"، "فقدان دانش تخصصی فناوری اطلاعات و قابلیت‌های ضروری حسابرسی فناوری اطلاعات"، "تجربیات ناکافی و سوابق نامناسب حسابرسان فناوری اطلاعات"، "فقدان دوره‌های آموزشی معتبر و عدم برخورداری حسابرسان از گواهینامه‌ها و مدارک معتبر بین‌المللی حسابرسی فناوری اطلاعات" و "اعتماد به نفس ناکافی حسابرسان"، از اصلی‌ترین چالش‌های اجرای فرآیند حسابرسی فناوری اطلاعات به‌شمار می‌رود. شناخت این چالش‌ها ضمن فراهم‌آوردن زمینه مطالعات آتی در خصوص تدوین چارچوب‌ها و مدل‌های پیاده‌سازی حسابرسی فناوری اطلاعات در بانک‌ها برای پژوهشگران، به مؤسسات اعتباری کمک می‌کند تا با شناسایی این چالش‌ها، اقدامات موثری جهت اجرای فرآیند حسابرسی فناوری اطلاعات انجام دهند.

کلیدواژه‌ها

• حسابرسی فناوری اطلاعات
• بازرسی فناوری اطلاعات
• صنعت بانکداری ایران
• چالش‌های اجرای حسابرسی
• حسابرسی داخلی

موضوعات

• رویکردهای مدیریتی در حوزه کسب‌ وکار هوشمند

عنوان مقاله [English]

Challenges to the implementation of information technology audit process in Iran's banking network

نویسندگان [English]

• Mojtaba Ahmadi ¹
• Alireza pourebrahimi ²
• Ladan Riazi ³
• Seyed Abdollah Amin Mousavi ⁴

¹ Ph.D Student, Department of Information Technology Management, Science and Research Branch, Islamic Azad University, Tehran, Iran

² iAssistant Professor, Department of Industrial Management, Karaj Branch, Islamic Azad University, Karaj, Iran Corresponding Author: poorebrahimi@gmail.com

³ Assistant Professor, Department of Information Technology Management, Science and Research Branch, Islamic Azad University, Tehran, Iran

⁴ Assistant Professor, Department of Industrial Management, Central Tehran Branch, Islamic Azad University, Tehran, Iran

چکیده [English]

In this paper, the challenges to the implementation of the IT audit process in Iran's banking network have been identified through a number of case studies in four large Iranian banks. The data has been collected through conducting 20 interviews with experts in both IT management and IT audit fields of the mentioned credit institutions, and reviewing some of their internal documents. In this research, 20 cases of the main challenges and problems in the implementation of the IT audit process were identified. The findings of the research showed the existance of "Lack of independence and existence of common financial interests", "Inability to establishing communication between IT audit unit and IT unit", "Inappropriate organization and administrative structure of the entity under audit", "Lack of specialized information technology knowledge and necessary capabilities" information technology audit", "insufficient experience and inappropriate records of information technology auditors", "lack of valid training courses and lack of auditors having valid international certificates and documents of information technology audit" and "insufficient self-confidence of auditors", are among the main challenges to the implementation of the audit process that is considered information technology.

Introduction

In this paper, the challenges to the implementation of the IT audit process in Iran's banking network have been identified through a number of case studies in four large Iranian banks. The data has been collected through conducting 20 interviews with experts in both IT management and IT audit fields of the mentioned credit institutions, and reviewing some of their internal documents. In this research, 20 cases of the main challenges and problems in the implementation of the IT audit process were identified. The findings of the research showed the existance of "Lack of independence and existence of common financial interests", "Inability to establishing communication between IT audit unit and IT unit", "Inappropriate organization and administrative structure of the entity under audit", "Lack of specialized information technology knowledge and necessary capabilities" information technology audit", "insufficient experience and inappropriate records of information technology auditors", "lack of valid training courses and lack of auditors having valid international certificates and documents of information technology audit" and "insufficient self-confidence of auditors", are among the main challenges to the implementation of the audit process that is considered information technology.
Among the most effective ways of evaluating and crediting the financial and management reports calculated with the help of information technology tools is information technology audit. Today, information technology control and audit have become an important mechanism to ensure integrated information systems and financial reports of organizations to prevent heavy financial failures in the future.
According to the Central Bank regulations, Iranian banks have been required to perform the information technology audit process and provide related reports in accordance with the ISACA ITAF. The evaluation shows unfavorable results. According to the issues raised, this research tries to use Stoll and Havelka's model (Stoll and Havelka, 2021), which lead to the successful implementation and improvement of information technology audit quality, including "organizational factors", "control factors" and "Individual factors of the auditor" has been devoted to the detailed analysis of problems, challenges and enabling and inhibiting factors in the field of challenges of implementing the IT audit process in the banking network of Iran.

Literature Review

"Information technology audit" is the inspection of the organization's IT systems and infrastructure to ensure that standards and guidelines are followed, documented, have the necessary efficiency, and operate effectively in line with business goals (ISACA, 2015a). The need for optimal implementation of the IT audit process has been recognized by many researchers as the main concern of many organizations today. Studies have mainly focused on IT audit concepts, dimensions, patterns and frameworks that can be used to properly implement the IT audit process. In this paper, considering that our focus is on reviewing IT audit challenges, articles have been reviewed and evaluated that mostly deal with the main challenges that most organizations face in this field. Information technology audit in banks is different from other organizations due to the sensitivity of business, complexity of operations, unique regulations, different characteristics and security needs, high-risk environment, the importance of maintaining customers' financial information and data confidentiality, and auditors should pay attention to General frameworks should be used to review and evaluate the information technology field of banks using the specific security standards and regulations of this industry.

Methodology

In the first stage, it has been helped to review the theoretical foundations and extract categories, concepts and key codes of the challenges of implementing the information technology audit process, and then in the second stage, each of the mentioned categories, concepts and key codes, according to the information obtained from the face-to-face interviews It has been analyzed with the participants and experts' opinions of both information technology and information technology audit. In order to accurately assess the problems, challenges and enabling and inhibiting factors in the optimal implementation of information technology audit, the information technology area of 4 Iranian banks (as a representative of four types of banks in the country including: government commercial, specialized government, semi-private and fully private), to conduct a case study has been selected. The current research is fundamental-applied in terms of research directions and a case study in terms of research strategy. The main tool for collecting information and data is through interview, observation and review of collected documents and documents, and therefore its approach is qualitative.

Results

The categories, concepts and the number of 20 key codes regarding the challenges of implementing the IT audit process were extracted based on the research literature and Stoll and Havalka's model (2021) and according to the information obtained from the interviews with the participants and the opinions of experts in both IT fields and Information technology audits were analyzed. The results indicate that "Lack of independence and existence of common financial interests", "Inability to establish communication between the information technology audit unit and the information technology unit", "Inappropriate organization and administrative structure of the entity under audit", "Lack of specialized information technology knowledge and capabilities" The necessity of information technology audit", "Insufficient experience and inappropriate records of information technology auditors", "Lack of valid training courses and lack of auditors having international valid information technology audit certificates and documents" and "Insufficient self-confidence of auditors", are among the main challenges of implementing the process. It is an information technology audit.

Discussion and Conclusion

Information technology audit is the main way to measure the effectiveness of information technology services, guarantee its efficiency and avoid threats and risks. In this paper, the challenges of implementing the IT audit process in Iran's banking network were identified through a case study in four large Iranian banks. The data has been collected by conducting twenty 45-minute interviews with experts in both IT management and IT audit fields of the mentioned credit institutions and reviewing some of their internal documents. In this research, 20 cases of the main challenges and problems of implementing the IT audit process were identified. Recognizing these challenges, while providing the background for future studies regarding the formulation of IT audit implementation frameworks and models for researchers, helps credit institutions to identify these challenges and take effective measures to implement the IT audit process. The study of this research included only four Iranian banks, which of course are among the large and complex organizations; However, it limits the generalizability of the results to other organizations and businesses, which is one of the limitations of this research.
Keywords: Information Technology Audit, Information Technology Inspection, Iranian Banking Industry, Audit Implementation Challenges, Internal Audit.
 
 
 

کلیدواژه‌ها [English]

• Information technology audit
• Information technology inspection
• Iranian banking industry
• Audit implementation challenges
• Internal audit