Checking assignments of controls to risks for internal control

ABSTRACT

It has become a more important role in society to manage Internal Control in industry while improper activities by well-known corporations are revealed one after another. Financial Instruments and Exchange Law is promulgated on June 14th, 2006, to impose documentation of financial reporting on Japanese listed companies.

To document financial reporting, each company has to evaluate control activities in administrative work-flows. Evaluation is to check if control activities in administrative workflows prevent or mitigate latent risks properly. The decision-making criteria for evaluation depend on the evaluator and are not seen explicitly. This causes lack of consistency of evaluation. To avoid inconsistency, the decision-making criteria for the evaluation should be specified precisely.

In this paper, we propose a decision-making criterion for evaluation and show how evaluation can be done with it. Evaluation with precisely defined decision-making criteria raises reliability of financial reporting. This research is helpful to construct an e-Government system for evaluations of business processes for Internal Control.

REFERENCES

• 1: Cafe OBJ: Cafe OBJ web page, http://www.ldl.jaist.ac.jp/cafeobj/.
• 2: Cafe OBJ Manual, http://www.ldl.jaist.ac.jp/cafeobj/documents.html.
• 3: Dines Bjorner, Software Engineering 3: Domains, Requirements, and Software Design (Texts in Theoretical Computer Science. An EATCS Series), Springer-Verlag New York, Inc., Secaucus, NJ, 2006
• 4: COSO (The Committee of Sponsoring Organizations of the Treadway Commision), Internal Control - Integrated Framework Executive Summary, http://www.coso.org/publications/executive_summary_integrated_framework.htm.
• 5: R. Diaconescu and K. Futatsugi, AMAST Series in Computing vol. 6, CafeOBJ report, World Acientific, 1998.
• 6: S. Goedertier and J. Vanthienen, Designing Compliance Business Processes from Obligations and Permissions, Proceedings of 2nd Workshop on Business Processes Design (BPD'06), Springer, 2006.
• 7: Guido Governatori , Zoran Milosevic , Shazia Sadiq, Compliance checking between business processes and business contracts, Proceedings of the 10th IEEE International Enterprise Distributed Object Computing Conference, p.221-232, October 16-20, 2006 [doi>10.1109/EDOC.2006.22]
• 8: K. Namiri and N. Stojanovic, A Model-driven Approach for Internal Controls Compliance in Business Processes, Proceedings of the Workshop SBPM 2007, online CEUR-WS.org/Vol-251/, 2007.
• 9: M. Muehlem and M. Rosemann, Integrating Risks in Business Process Models, Proceedings of 16th Australasian Conf. on Information Systems, 2005.
• 10: K. Ogata and K. Futatsugi. Proof Scores in the OTS/Cafe OBJ Method, Proceedings of the 6th IFIP WG6.1 International Conference on Formal Methods for Open Object-Based Distributed Systems (6th FMOODS), pp. 170--184, Springer, 2003.
• 11: K. Ogata and K. Futatsugi. Some Tips on Writing Proof Scores in the OTS/Cafe OBJ Method, Proceedings of the Festschrift Symposium in Honor of Joseph A. Goguen (Algebra, Meaning, and Computation: Essays Dedicated to Joseph A. Goguen on the Occasion of His 65th Birthday), pp. 596--615, Springer, 2006.
• 12: protiviti, J-SOX Flash Report, http://www.protiviti.jp/downloads/flashreport/JSOX_Flash_Report0221E.pdf
• 13: M. Sasano, Naibutousei no nyuumon to jissen, 2nd edition (Introduction and Practice of Internal Control, 2nd Edition), Chuuou Keizaisha, 2007.

INDEX TERMS

Primary Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.1 Requirements/Specifications
          Subjects: Elicitation methods (e.g., rapid prototyping, interviews, JAD)

Additional Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.1 Requirements/Specifications
          Subjects: Languages; Tools; Methodologies (e.g., object-oriented, structured)

General Terms:
Verification

Keywords:
domain description, formal analysis, internal control