Internal control framework for a compliant ERP system

After the occurrence of numerous worldwide financial scandals, the importance of related issues such as internal control and information security has greatly increased. This study develops an internal control framework that can be applied within an enterprise resource planning (ERP) system. A literature review is first conducted to examine the necessary forms of internal control in information technology (IT) systems. The control criteria for the establishment of the internal control framework are then constructed. A case study is conducted to verify the feasibility of the established framework. This study proposes a 12-dimensional framework with 37 control items aimed at helping auditors perform effective audits by inspecting essential internal control points in ERP systems. The proposed framework allows companies to enhance IT audit efficiency and mitigates control risk. Moreover, companies that refer to this framework and consider the limitations of their own IT management can establish a more robust IT management mechanism. 2013 Elsevier B.V. All rights reserved. * Corresponding author at: School of Economics and Business, SUNY College at Oneonta, USA. Tel.: +1 607 436 3458; fax: +1 607 436 2543. E-mail addresses: [email protected] (S.-I. Chang), [email protected] (D.C. Yen), [email protected] (I.-C. Chang), [email protected] (D. Jan).