IT governance and IT controls: Analysis from an internal auditing perspective

Abstract

Inadequate information technology (IT) management can lead to system ineffectiveness and operational stagnation within enterprises. While the application of IT governance provides a means for companies to validate IT functionality, oversee IT operations, and mitigate IT-associated risks, there is a paucity of research examining its implications of IT governance on IT controls, particularly within the context of a firm’s Internal Audit Function (IAF). Addressing this gap in the literature, this research delves into the relationship between the characteristics of the IAF and IT governance within the IAF. It further probes the linkage between IT governance associated with the IAF and IT control activities. We analyze survey data from 414 internal auditors across various Taiwanese companies using partial least squares regression. The findings suggest that IT knowledge and internal auditing roles have a significantly positive relationship with the quality of the IAF-IT relationship and IT governance processes. Similarly, IT audit competencies exhibit a significantly positive relationship with IT governance processes. Furthermore, properly structured IT governance processes and a high-quality IAF-IT relationship demonstrate a positive association with the effectiveness of general controls. This research amalgamates and extends prior investigations into IT governance and internal auditing, underlining their critical role in successfully implementing superior IT controls.