systems have the potential to change the way risk
management function in the organization. In this
work, we conducted a survey of internal auditor to
identify the impact that these systems are having on
the audit function.
Based on our survey responses, we can infer that on
one hand, ERP systems lead to a significant
improvement in internal auditors’ ability to assess
and manage risk in most risk categories. On the other
hand, we see an increases levels for in technology
risk factors and operational risk factors, a decrease in
financial risks, and wider variation in miscellaneous
risk factors. The survey also indicates that internal
auditors are spending more time in quality assurance
in processes rather and less time in managing crises.
However, we were surprised that internal auditors did
not play a more important role in implementation,
particularly in defining internal control or being part
of the reengineering effort necessitated by ERP
adoption.
This study is subject to limitations common to survey
research design. In the early post-Sarbanes-Oxley
period, volunteers responded to mostly objective
questions which might not elicit the full range of their
perspectives, perspectives which we assume mirror
reality Our research raises many questions for future
research. Our study captures internal auditors’
perspectives but raises the questions why they hold
those perspectives or how they came to hold them.
Why were most of the implementations internally
focused with so few integrated with suppliers and
customers? What drove the choice of ERP vendors
and did this choice relate to company or industry
characteristics? Why were internal auditors generally
only “somewhat involved” in the design and
implementation of new internal controls into the
system? If the organization or its culture changed,
was that change the cause of, the result of, or was it
independent of the ERP implementation? To what
extent were the perceptions of risk affected not just
by the implementation but also by such
organizational or cultural changes? Finally, Sarbanes
Oxley has and continues to dramatically affect
publicly listed companies’ scrutiny of internal
controls. Whether this has added impetus for full
integration of all ERP modules, company-wide and
how internal auditors are affected by these changes
warrants research on an on-going basis