Decision Support Systems 47 (2009) 436454

Contents lists available at ScienceDirect

Decision Support Systems

j o u r n a l h o m e p a g e : w w w. e l s ev i e r. c o m / l o c a t e / d s s

A business process gap detecting mechanism between information system process

ow and internal control ow
Shi-Ming Huang a,1, David C. Yen b,, Yu-Chung Hung a,1, Yen-Ju Zhou a,1, Jing-Shiuan Hua c
a
b
c

Department of Accounting & Information Technology, National Chung-Cheng University, Chia-Yi, Taiwan, ROC
Department of DSC & MIS, Miami University, Oxford, OH 45056, USA
Department of Management Information Systems, National Chung-Cheng University, Chia-Yi, Taiwan, ROC

a r t i c l e

i n f o

Article history:
Received 26 March 2008
Received in revised form 26 February 2009
Accepted 15 April 2009
Available online 22 April 2009
Keywords:
Computer-Assisted Audit Techniques and
Tools (CAATTs)
Business process gap detecting mechanism
Database log
Resource and value dependence method
Internal control ow

a b s t r a c t
The information system (IS) has become an important backbone of the modern enterprise, which has caused
electronic data generated by the IS to be more easily manipulated and destroyed than hardcopy data. It is
therefore important for auditors to assure that the IS is well-controlled and secure. Auditors generally use
Computer-Assisted Audit Techniques and Tools (CAATTs) to assist them in auditing the IS, though given the
growing complexity of these systems, it is hard to completely perform a control test of the systems. This
research aims to develop a mechanism, namely the Business Process Gap Detecting Mechanism (BPGAPDetecting Mechanism), to automatically detect the business process gap between IS processes and internal
control ows. This study also justies the feasibility of BPGAP-Detecting Mechanism by providing a real case
study. The result indicates that the BPGAP-Detecting Mechanism can assist the case company in resolving
data quality problems that have occurred in its ERP (Enterprise Resource Planning) system and can also
provide additional information for the company.
2009 Elsevier B.V. All rights reserved.

1. Introduction
During the last several decades, the information system (IS) has
become the backbone of the modern enterprise because of its
efciency and effectiveness. However, electronic data generated by
the IS have become easier to change, manipulate, or destroy. These
aspects of IS have created an easier way for crime to take place [16].
This fact was quantied in the 2005 Computer Crime and Security
Survey, which revealed that losses caused by computer crimes and
computer security breaches were $130,104,542 for the 639 respondents in 2005 [17]. Hence, it is important for auditors to assure that ISs
are adequately controlled, secured, and function as intended [39].
Reassuring IS security in the modern business environment
requires a complete understanding of the continuous events that
comprise the way businesses organize their activities. An important
way to attain this understanding is to deconstruct a business into its
underlying business processes [5]. It should be noted that the
SarbanesOxley (SOX) Act [44] requires both managers and auditors
to force rms to follow their business activities more closely and verify

Corresponding author. Tel.: +1 513 529 4827 (ofce); fax: +1 513 529 9689.
E-mail addresses: [email protected] (S.-M. Huang), [email protected]
(D.C. Yen), [email protected] (Y.-C. Hung), [email protected]
(Y.-J. Zhou), [email protected] (J.-S. Hua).
1
Tel.: +886 4 272 0411x16811.
0167-9236/$ see front matter 2009 Elsevier B.V. All rights reserved.
doi:10.1016/j.dss.2009.04.011

controls over the rm's nancial reporting processes [23]. To improve

the performance and efciency of business processes, IS activities
should be recorded in a log that indicates when and who accesses
what data [3]. These logs should be reviewed frequently to ensure that
system activities parallel business activities [43].
However, the increasing complexity and variety of IS along with
the need to uncover unrevealed information provides auditors with
serious challenges. It is difcult to audit the IS if auditors do not know
the data structure and process ow inside the system. When auditing
the IS, either the control test or the substantive test is conventionally
required. The control test indicates the illegal actions which have
violated internal controls, while the substantive test is performed to
test the material misstatements afterwards [40]. In general, auditors
use the Computer-Assisted Audit Techniques and Tools (CAATTs) to
support them in auditing these systems [11,36,43]. Most CAATTs
provide the substantive test of the IS, but it is more effective to review
the controls of the systems than to audit the output data [53]. In
addition, the CAATTs which only provide the substantive test of the IS
may fail to nd the business process gap between IS process ow and
internal control ow. The above phenomenon may lead to poor data
quality, the mask-up effect, incorrect decision-making, or fraudulence.
Therefore, the control test is essential for the CAATTs to ensure that
the business process gap does not exist between IS process ow and
internal control ow. In specic, both the control test and substantive
test should be included to complement each other in the CAATTs. In
practice, auditors should not only audit the output data produced after

S.-M. Huang et al. / Decision Support Systems 47 (2009) 436454

the IS process ow, but audit the activities conducted during the IS
process ow itself. For some complex information systems, they need
to perform more control tests rather than only substantive tests or
control tests in order to reduce the audit risk to an appropriate level
[57].
It is doubtless that CAATTs can help auditors to audit the IS in
either a static or dynamic way. Although many CAATTs were proposed
in the past two decades, they are still in their infancy and possess
some limitations and drawbacks. Generalized Audit Software (GAS),
Parallel Simulation, Test Data, and Integrated Test Facility (ITF) focus
on the output data produced by the IS. They provide the substantive
test and risk assessment, and cannot detect the business process gap
between the IS process ow and the internal control ow. Although
the concept and execution of the control test are not difcult to realize,
the prototype systems/commercial software which can perform the
control test are limited.
An Embedded Audit Module can detect the business process gap
between the IS process ow and the internal control ow by working
with the IS. However, it is difcult to construct a general system which
can combine with different IS. Additionally, client cooperation is also a
disadvantage of Embedded Audit Module [20], as auditees are not
always willing to be cooperative with auditors, whose applications
affect their IS. In short, because of the complexity of the IS without
combining the CAATTs with these systems, it is difcult to conduct the
entire control test of the IS.
As a result, this paper aims to propose a mechanism to automatically perform a control test of the IS of rms. This prototype
system is expected to achieve the following objectives:
automatically identify the internal control for the audit objects;
automatically identify the IS process ow for the audit objects;
automatically compare the internal control ow with the IS ow to
detect any differences between these two ows.
In addition to the aforementioned objectives, this study can also be
recognized as an effective development practice which can provide
the structured form, formal logic and mathematical algorithm for the
whole auditing process and can be used as a reference for future
researchers and practitioners.
2. Literature review
2.1. Computer-assisted audit techniques and tools
Over the past two decades, several CAATTs were proposed by prior
studies of auditing [11,13,15,20,36,43], such as GAS, Parallel Simulation, Test data, ITF, the Embedded Audit Module, and so on. This study
classies them into three categories: Substantive Tests, Control Tests,
and Hybrid Tests including both Substantive Tests and Control Tests.
The classication of CAATTs is tabulated in Table 1.

Table 1
Classication of computer-assisted audit techniques and tools.
Test type

CAATTs

Estimated by

Degree of
embedded on
client's system

Software

Substantive
test

Generalized Audit
Software(GAS)
Parallel Simulation
Test data
Integrated Test
Facility (ITF)
Embedded audit
module

Output data

N/A

ACL/IDEA

Output data
Output data
Output data

N/A
N/A
Middle

N/A
N/A
N/A

System processing/
output data

High

Oracle/SQL
Server /IBM
DB2

Control test

Both

437

The purpose of the substantive test is to ensure the integrity and

data quality of the output data produced by the IS. Both GAS and
Parallel Simulation can perform the substantive test, though GAS is the
most frequently used technique of CAATTs [11]. GAS software like
Audit Command Language (ACL) and Interactive Data Extraction and
Analysis (IDEA) are widely employed by rms. It has a friendly user
interface to extract the data produced by the systems and analyzes the
patterns of variables. By constructing another identical IS, Parallel
Simulation will compare and verify the data produced by both systems
to detect the gap/difference between two systems.
The control test, including risk assessment and compliance tests, is
used to ensure IS process ows. Both Test Data and ITF can perform the
control test. Test Data is a technique in which auditors prepare the
input data for the auditee's IS and analyze the output results to assess
the potential risk of the systems. The ITF is similar to the Test Data, as
both ITF and Test Data employ some dummy data as test sets to help
auditors analyze the output result of the dummy test data and to
detect any potential risk.
The Hybrid Test, like the Embedded Audit Module, can perform
both substantive tests and control tests. The Embedded Audit Module
combines the audit module with the IS, and can therefore monitor the
IS process ow and collect data. However, it is less popular due to its
difculty in getting cooperation of the auditee and in constructing a
general system which can combine with different ISs.
2.2. Dynamic modeling tools for internal control ow
Internal control is a process that permeates an organization's
activities and hence, provides reasonable assurance that the following
control objectives are achieved [43]. To this end, internal control is
critical to any business organization. Without the ability to ensure the
accuracy and reliability of information produced by ISs, it is difcult
for a business organization to survive in a competitive environment
[8]. Furthermore, the implementation of ISs and other associated
systems performed in business process is not straightforward [19]. For
these reasons, it is necessary to assure that the IS process ow
conforms to the planned control objective. The design and evaluation
of systems of internal control also have become important tasks to
auditors. This is because they are charged with responsibility of
certifying to the reliability of information produced by ISs [8].
Auditors evaluate information reliability by assessing whether or
not the appropriate system controls are in place and under operating
effectively [18]. Almost all practicing auditors employ some sort of
internal control system, such as questionnaires, narrative descriptions,
and owcharts, in their resulting evaluation process [8]. Utilizing the
computer-assisted methods has the unique advantage of bringing the
speed, accuracy, and great memory capacity of the computer to carry
out the internal control evaluation problem [8,34]. The computerassisted evaluation actually allows the utilization for larger and more
complex models. Moreover, it can be much more rigorous than the
using of manual methods [8,34].
To complete the assessments of the reliability of system controls, IS
auditors rstly need to understand the IS processes information [18].
In order to realize the system and thus, conduct the control test for an
IS, auditors rely heavily on an understanding of the internal control
ow of the IS. Therefore, it is important to choose a suitable,
computer-assisted dynamic modeling tool to keep track of the internal
control ow of the IS. The most common tools are: Flowchart [21],
Event-driven Process Chain (EPC) [56], extended Event-driven Process
Chain (eEPC) [25,46], IDEF [7], Unied Modeling Language (UML)
[10,45], Data Flow Diagram (DFD) [47,52], Business Process Modeling
Notation (BPMN) [49], and Petri-Net [12]. Table 2 classies them into
three categories: workow model, dataow model, and mathematical
model. The classication can focus the modeling tools on the usage.
The purpose of the workow model is to depict the dynamic
workow which has the sequential, iterative, parallel, and conditional

438

S.-M. Huang et al. / Decision Support Systems 47 (2009) 436454

Table 2
Classication of the dynamic modeling tools.

Table 3
Mapping dynamic modeling tools to Petri-Net.

Classication

Description

Modeling tools

XML

Software

Author

Modeling tools

Year

Workow
model

Modeling the sequential,

iterative, parallel, and
condition properties of the
workow for information
systems

N/A
EPML
EPML
BPEL
N/A
UXF

DFD to Petri-Net
EPC to Petri-Net
UML Activity Diagrams to Petri-Net
IDEF0 to IDEF3 and IDEF3 to Petri-Net
IDEF0 and IDEF3 to Petri-Net

1992
1999
2001
2001
2004

Modeling the ow of data

through the process of
information system

Visio
Visio
AXIS/Visio
N/A
BPWIN
Rational
Rose/Visio
Visio
ARIS/Visio
Rational
Rose

Lee and Tan

Aalst
Meena et al.
Kim et al.
Lee et al.

Data ow
model

Flowchart
EPC
eEPC
BPMN
IDEF3
UML activity
diagram
DFD
eEPC
UML
interaction
diagram
Petri Net
IDEF2

Mathematical
model

Combining the graph

description and mathematical
analysis to simulate and
analyze information system

N/A
EPML
UXF

PNML
N/A

CPN Tool
Witness

the tokens will be removed from the input places and are added to the
output places according to the weight of the input arc and output arc
[2,31]. Then the conditions or the resources of the systems are said to
be changed or moved from one to another one, and the marking of the
Petri-Net is updated to represent the new state.
2.4. Reachability analysis of the Petri-Net

properties of the IS. The purpose of the dataow model is to depict the
dynamic dataow through the processes. The workow model and
dataow model can contain the fundamental ows of the IS, but they
cannot provide any simulation and analysis method. Therefore, to
simulate and analyze the system, a mathematical model is needed.
Mathematical models can depict the IS by using graphical notation
and performing dynamic simulation and mathematical analysis on the
model.
2.3. The mathematical model: Petri-Net
Petri-Net is a mathematical modeling tool which was invented by
C. A. Petri (1962) to describe and simulate the concurrent processes
of the networks [58]. It provides both graphical description and
mathematical analysis capabilities and is widely used in simulating
and analyzing the concurrent, asynchronous, distributed, and
stochastic systems [28,37,54].
A Petri-Net is dened by 5 tuples:
PN = (P, T, F, W, M), where:

P is the set of places.

T is the set of transitions.
Fp(P T)(T P) is the set of arcs.
W is a function which means the weight of the arc.
M is the marking vector which means the number of tokens in each
place when a Petri Net is static.

When the transitions are ring, which means the processors, the
tasks, or the functions of the systems are executing, the numbers of

The major strength of the Petri-Net is to analyze the properties of

a complicated system or problem in an easy and well-constructed
way. In this research, reachability analysis of the Petri-Net is used to
detect any business process gap. If a marking Mb is possible to reach
from Ma after a sequence of transitions is red, it is said that Mb can
be reached from Ma. The Incidence Matrix and State Equation can
analyze the reachability of Petri-Net. The method creates a matrix:
Incidence Matrix I based on the Petri-Net. Each row of I is the place
and each column of I is the transition. Elements Ei,j in I means the
number of tokens changed of place j when transition i red. After
creating the Incidence Matrix, it can be performed on the State
Equation: Mb = Ma + I ring vector to predict the reachability
between Ma and Mb. Firing vector is a vector of non-negative integers
which maps every transition to its number of occurrences in a ring
sequence [9,50]. This method is easy to implement on computers
because of the mathematical formula. Fig. 1 is a simple example of the
Incidence Matrix and State Equation. By comparing the vector values
in Ma and Mb, the reachability of Petri-Net can detect the difference
between two data sets. The example that illustrates this reachability
can be seen in the Section of 3.5.
2.5. Mapping workow and dataow models to mathematical model
The workow and dataow models are more familiar than the
mathematical model for human beings, but they only have the
graphical description capability. Therefore, many researchers
map workow and dataow models to the mathematical
model: Petri Net [1,27,29,30,33]. Table 3 summarizes the conversion from the workow and dataow models to mathematical
model: Petri-Net.

Fig. 1. The incidence matrix and state equation of Petri-Net.

S.-M. Huang et al. / Decision Support Systems 47 (2009) 436454

3. System architecture
The objective of this research is to develop an automatic mechanism
to detect the business process gap between the IS process ow and the
internal control ow. The mechanism should be automatic in order to
support continuous auditing [24,40,41]. The audit object of the automatic
mechanism is the business process compliance test, and the audit
evidence the automatic mechanism needs includes the IS process ow
and internal control ow. The automatic mechanism has three phases:
Phase1: Identifying the internal control ow for audit object.
Phase2: Identifying the IS process ow for audit object.
Phase3: Business process gap analysis.

439

gap-detecting mechanism. This three phase architecture is widely

used in other gap detecting architecture approaches.
After Phase3, an analysis report is produced to identify the
business process gap between IS process ow and internal control
ow. The business process gap may exist due to nonstandard actions
taken by end users, modication of systems without updating internal
control ow, primary error of the systems, a security aw of the
system, etc. Once the analysis report indicates that the IS has a
business process gap, auditors need to determine why the business
process gap exists and formulate the audit report. Fig. 2 illustrates the
whole mechanism. The three phases of the automatic mechanism are
interpreted in detail in the following sections.
3.1. Phase1: identifying the internal control ow for audit object

The three phases use a simple logical inference method. Phase1

and Phase2 will identify and reconcile the two pieces of audit
evidence, while Phase3 is the kernel algorithm of the business process

3.1.1. Phase1-1: depicting the internal control ow

The SarbanesOxley (SOX) Act section 404 requires the enterprise
to document their processes that are supported by IS [14]. Therefore,

Fig. 2. Business process gap detecting mechanism.

440

S.-M. Huang et al. / Decision Support Systems 47 (2009) 436454

under the SOX, enterprises should have the documentation of the

internal control ow of their IS.
The IS is comprised of the workow and dataow [52]. Therefore,
the internal control ow of the IS can be identied by using the
workow and dataow models. In this research, the eEPC (extended
Event-driven Process Chain) diagram is chosen as the workow and
dataow model for internal control ow. The eEPC diagram extended
the workow model EPC (Event-driven Process Chain) by providing it
with enhanced resources [46] so that it involves both the workow
and dataow. The eEPC has also been widely used. The leading ERP
(Enterprise Resource Planning) system vender SAP adopts it to
illustrate the SAP R/3 system's processes [26] and the leading BPM
(Business Process Management) system vender, IDS-Scheer, also
embedded it as the basic element of the control view, which integrates
the data view, function view, and organization view within the
Architecture of Integrated IS (ARIS) framework [46]. Denition1
formalizes the syntax of the eEPC based on the syntax of EPC [1].
Denition 1. (extended Event driven Process Chain): An extended
Event-driven Process Chain is three tuple: eEPC = (G,R,DF),where:
G is a basic EPC, G = (E, F, C, T, A).
R is a nite set of resources.
DFp(F S)(R F) is a set of dataow arcs.
There should rst be an underlying EPC diagram which describes
the basic workow of the IS. Then, resources and dataow arcs are
added on the EPC diagram where dataow arcs connect the resources
and the functions of EPC. The underlying EPC should follow the
requirements of EPC formalized by Aalst [1] to avoid conict of the
workow. The dataow should also contain some detailed denitions
about what operations the functions perform on the resources.
Denition2 denes the operations according to the direction of the
dataow. It classies the operations into input dataow operation and
output dataow operation. The details of the input dataow operation
and the output dataow operation are based on the Data Manipulation Languages (DML) of the database.
Denition 2. (Operations of Dataow): Let eEPC = (G, R, DF) and
DF = (SELECT, INSERT, UPDATE, DELETE), where:
DFp(R F)DF = (SELECT),
an input dataow arc must have a SELECE operation.
DFp(F R)DF = (INSERT, UPDATE, DELETE),
an output dataow arc must have an INSERT, UPDATE, or DELETE
operation.

Fig. 3 illustrates the eEPC diagram for a standard sales-to-delivery

cycle of SAP R/3's Sales and Distribution (SD) module [51]. The eEPC
has three functions (i.e. NEW SALES ORDER DOCUMENT, MODIFY
SALES ORDER DOCUMENT, and NEW DELIVERY) and four resources
(i.e. SALES DOC. HEADER: VBAK, SALES DOC. ITEM: VBAP, DEVILY
HEADER: LIKP, and DELIVERY ITEM: LIPS). The three functions perform
operations on the four resources. For example, the NEW SALES ORDER
function performs the INSERT operation on the SALES DOC. HEADER:
VBAK and SALES DOC. ITEM: VBAP.
3.1.2. Phase1-2: constructing the mathematical model of the internal
control ow
To perform an analysis with the model, this paper needs to
construct the mathematical model of the internal control. Petri-Net is
chosen as the mathematical model in this research. Aalst [1] has
formulized the transformation methods between the EPC diagram and
Petri-Net. In this research, the elements involved in workow (i.e.
Events, Functions, and Connectors) and dataow (i.e. Resources and
Dataow) need to convert to Petri-Net. This paper adopts the
transformation rules of Aalst [1] for the workow part of eEPC. The
rules are described in Figs. 4 and 5, respectively. The Event, Function,
and Resource mapping between the eEPC diagram and Petri-Net were
provided in Fig. 4. The AND and XOR Connectors mapping between the
eEPC diagram and Petri-Net are illustrated in Fig. 5.
According to denition2, the dataow part of eEPC contains four
operations (i.e. SELECT, INSERT, UPDATE, and DELETE). Therefore, the
transformation is constructed based on the idea of resource lock for
the four operations of dataow part of eEPC. Fig. 6 illustrates the
SELECT, INSERT, UPDATE, and DELETE dataow mapping between the
eEPC diagram and Petri-Net.
3.1.3. Phase1-3: adjusted Petri-Net of the internal control ow
Petri-Net, which is converted from eEPC, should be adjusted
to reconcile with the structure of the IS process ow. The reconciliation of the ow can reduce the conicts of the internal control
ow and IS process ow when performing the analysis mechanism.
First, the resources which do not affect the major transactions in
Petri-Net should be removed. Second, to avoid the ignored dataow,
the weight of the arcs between dataow places and dataow
transitions are adjusted to equal 2. This means that the dataow
places must require two tokens for ring the connected dataow
transitions. Once the dataows are scanned from the IS process ow,
one token is put into the corresponding places of the internal control
ow, so that there are two tokens in the corresponding places and the
connected dataow transitions can re. The token in dataow places

Fig. 3. Sales-to-delivery cycle of SAP R/3 SD.

S.-M. Huang et al. / Decision Support Systems 47 (2009) 436454

441

Fig. 4. Event, function and resource mapping.

of the internal control ow will not move to other places if a business

process gap exists between it and the IS process ow. Third, the
transition: RESOURCE UNCONCERNED is added for all resources to
reduce the tokens of the resources place in case the resources may
become irrelevant later. While executing the SELECT operation of a
dataow, the original token will be reserved in the initial resource
place and the new copied token will be moved to other places. At the
end of the dataow, the reserved token may become irrelevant. For
example, SALES DOC. HEADER (which can be represented by VBAK)
and SALES DOC. ITEM (which can be represented by VBAP) are
relevant in SALES process, but irrelevant in the DELIVERY process.
Therefore, it is required that the transitions are added for all resources
to reduce the reserved token.
Denition3 formulizes the adjusted Petri-Net in this research. After
transferring the eEPC (Fig. 3) to the Petri-Net according to the
mapping rules in phase1-2, the transferred Petri-Net is adjusted as in
Fig. 7 by Denition3. The weights of the six arcs between dataow
places and dataow transitions (i.e. the arc between INSERT VBAK
dataow places and INSERT VBAK dataow transitions) are adjusted
to 2. Four transitions (i.e. VBAK UNCONCERNED) are added for the
four resources including VBAK, VBAP, LIPS, and LIKP to avoid the
resources' potential irrelevance later.
Denition 3. (Asjusted Petri Net): Let N (eEPC) be the Petri Net
which is converted from standard procedure (eEPC), an asjusted Petri
Net mN (eEPC) is satised:
Remove Basic Resources (Rb) and Unconcerned Resources (Ru) in N
(eEPC).
Adjust the weight of the arc between dataow place and dataow
transition equals to 2 in N (eEPC).
Add the transitions: RESOURCE UNCONCERNED for all resources to
reduce tokens of the resources place.
3.2. Phase2: Identifying the IS process ow for audit object
3.2.1. Phase2-1: extracting database log
The second phase identies the IS process ow. The IS process ow
has both a logical workow and physical dataow, wherein the logical
workow is physically implemented by the physical dataow [52].
Identifying the logical workow of IS is more difcult than the
physical dataow. Various IS have various workow log structures, though almost all database management systems (DBMS) have
the same database log structure. However, because the logical workow
is physically implemented by the physical dataow, this study can use
the physical dataow and extend it to represent the logical workow.
For instance, the logical workow: NEW SALES ORDER DOCUMENT is
physically implemented by the physical dataow: INSERT VBAK and
INSERT VBAP. This study supposes that if dataow of INSERT VBAK and
INSERT VBAP is performed, it must be performed by the workow: NEW
SALES ORDER DOCUMENT. Therefore, the physical dataow (INSERT
VBAK and INSERT VBAP) can be extended to the logical workow (NEW
SALES ORDER DOCUMENT). It is then possible to combine the extended
workow and the dataow with the IS process ow. The extension of

physical dataow to logical workow is implemented in Phase3:

Business Process Gap Analysis.
The database log of DBMS, which records how IS use database
manipulation language (DML) commands to interact with DBMS, is
the result of the physical dataow. Retrieving the database log is easy
because DBMS such as Oracle and Microsoft SQL (Structured Query
Language) Server can provide the log le, which records activities run
on them in a common structure [35,38,42].
3.2.2. Phase2-2: resource and value dependence method
In practice, there may be numerous tasks executing in parallel
within the IS that will cause the database to log chaotically. Unless
there is a method to group the log data by task, it is impossible to
proceed to the analysis mechanism of the mathematical model. In
order to deal with the chaos of the database log, this research uses a
Resource and Value Dependence Method to distinguish the DML
commands in the database log from one task to another.
Denition 4. (Log and Tasks): Let L be the database log.
T be the set of tasks, where TpL.
Tasks are different assignments in the process instance.
Denition4 denes the relationship of the log and the tasks. Before
proceeding to the Resource and Value Dependence Method, it is
important to break down the resources of the IS to the most basic
resources, the transaction resources and the unconcerned resources. The
basic resources are the resources that are only needed during the
transaction. For example, Material Master Sales Document: Header Data
(which can be represented by MARA) is the basic resource in SAP R/3 SD.
The transaction resources are the resources that are produced or altered
during the transaction. VBAK, VBAP, LIKP (Delivery: Header Data), and
LIPS (Delivery: Item Data) are the transaction resources in SAP R/3 SD.
Unconcerned resources are those resources that are not related during
the transaction. Denition5 formalizes the three resources of IS.
Denition 5. (Basic Resources, Transaction Resources, Unconcerned
Resources):
Let R be the resources of eEPC, R = RbRtRu, where
Rb is a set of basic resources.
Rt is a set of transaction resources.
Ru is a set of unconcerned resources.
The Resource and Value Dependence Method is separated into
Resource Dependence and Value Dependence. Since Value Dependence relies on Resource Dependence, it is important to rst dene
the Resource Dependence. Denition6 formalizes the Resource
Dependence of the DML commands.
Denition 6. (Resource Dependence of DML Commands): DR = (ci,cj),
ci,cj2L,
i,j = 1,2,,n, which means Data Manipulation Language (DML)
Commands:
ci and cj in database log has Resource Dependence DR.

S.-M. Huang et al. / Decision Support Systems 47 (2009) 436454

Fig. 5. AND and XOR connectors mapping.

442

443

Fig. 6. SELECT, INSERT, UPDATE, and DELETE dataow mapping.

S.-M. Huang et al. / Decision Support Systems 47 (2009) 436454

444

S.-M. Huang et al. / Decision Support Systems 47 (2009) 436454

Fig. 7. Adjusted Petri-Net for sales-to-delivery cycle of SAP R/3 SD.

DR = DRttDRtbDRbb, where:
DRtt = {(ci,cj)|(PKRs)(ci)p(FKRs)(cj), if Rs(ci)2 RtRs(cj)2Rt}
DRtb = {(ci,cj)|(FKRs)(ci)t(PKRs)(cj), if Rs(ci)2 RtRs(cj)2Rb}
DRbb = {(ci,cj)|(PKRs)(ci)p(FKRs)(cj), if Rs(ci)2 RbRs(cj)2Rb}
where:
Rs (c) is the function which maps command c's resource.
PK (r) is the function which maps resources r's primary keys.
FK (r) is the function which maps resources r's foreign keys.
The two resources basic resource Rb and transaction resource Rt
break down Resource Dependence into three different relationships:
DRtt, DRtb, and DRbb. DRtt is the Resource Dependence of two
transaction resources, DRtb is the Resource Dependence of the
transaction resource and basic resource, and DRbb is the Resource
Dependence of two basic resources.
It is easy to understand Resource Dependence when thinking about
the character of primary keys and foreign keys of each entity in the
Entity Relationship Model (ER Model). In the ER Model, there exists a
relationship between two entities if one entity's foreign keys are
referenced from the other's primary keys [48]. Therefore, in a database
log, there exists Resource Dependence between two DML commands if
the two resources involved in the commands have a relationship.

After satisfying Resource Dependence, it is possible to separate the

tasks based on the Value Dependence. Denition7 denes the Value
Dependence of the commands.
Denition 7. (Value Dependence of DML Commands): DV = (ci,cj)ci,cj
2 L,
i,j = 1,2,,n, which means Data Manipulation Language (DML)
Commands:
ci and cj in database log has value dependence DV.
DV = DVttDVtbDVbb, where:


9
=
VBPKBRsci = VBFKBRs cj ;






DVtt =
ci ; cj j
:
if Rsci aRt 1Rs cj aRt 1 ci ; cj aDRtt ;


8
9
<

=

VBFKBRsci = VBPKBRs cj ;





DVtb =
ci ; cj j
:
if Rsci aRt 1Rs cj aRb 1 ci ; cj aDRtb ;


8
9
<

=

VBPKBRsci = VBFKBRs cj ;






DVbb =
ci ; cj j
:
if Rsci aRb 1Rs cj aRb 1 ci ; cj aDRbb ;
8
<

where:
V(k) is the function which maps key k's value in database log.

S.-M. Huang et al. / Decision Support Systems 47 (2009) 436454

445

primary key (PK), PK value, foreign key (FK), FK value, and a

transactions ID. The log will clearly be chaotic as a result of the parallel
execution of the two tasks, and thereby cannot proceed to the analysis
mechanism. According to Denition5, all entities of the database log in
Table 4 are transaction resources except that C1 is a basic resource. The
Resources Dependence of entities within the database log can be
derived according to Denition6. For example, the Resources
Dependence between C2 and C3 exists because C3's foreign key
(VBAK.VBELN) is referenced from C2's primary key (VBELN). After
deriving the Resources Dependence of entities, the Value Dependence
of entities with Resources Dependence also can be extracted by
Denition7. For example, the Value Dependence between C2 and C3
also exists besides Resources Dependence because the values of C2's
primary key (VBELN) is the same as the value of C3's foreign key
(VBAK.VBELN). Therefore, the three different relationships of Value
Dependence can be dened so that DVtt = {(C2,C3), (C2,C4), (C3,C12),
(C4,C13), (C5,C6), (C5,C10), (C6,C8), (C7,C8), (C9,C6), (C9,C10),(C11,
C12), (C11,C13)}, DVtb = {(C1,C3), (C1,C4), (C1,C6), (C1,C10)}, and
DVbb. = {}. By then proceeding to the Algorithm1, the interrelated
entities can be extracted from the sets of DVtt and grouped into each
task. Therefore, there are two tasks: T1 = (C2, C3, C4, C11, C12, C13)
and T2 = (C5, C6, C7, C8, C9, C10) in this log.
However, a problem still exists. The eEPC only models the abstract
dataow between resources and functions, and therefore cannot tell us
how many DML commands are performed in the dataow. For example,
according to eEPC in Fig. 3, this study only knows that the NEW SALES
ORDER function will perform INSERT on VBAK and VBAP, when in fact
the INSERT operation is executed twice on VBAP in ORDER: 7394 since
there are two items in one order. Therefore, this requires a grouping of
DML commands into each operation processed by a function in one task.

Since Value Dependence relies upon Resource Dependence, it also

breaks down into three different relationships: DVtt, DVtb, and DVbb.
The Resource Dependence can ensure that the resources of the two
DML commands are related. However, to distinguish between tasks
within the database log, a comparison of their values is needed. Two
DML commands may possess Value Dependence if they satisfy the
following requirements:
1. They have Resource Dependence.
2. The values of one's primary keys are the same with values of the other
one's foreign keys which are referenced from the primary keys.
The database log is now comprised of many Value Dependencies
DVp = (ti,tj), p = 1,2,,m and i,j 2 1,2,,n. This study then follows
Algorithm1 to group the DML commands in database log relative to
each task.
Algorithm 1. (Group Database Log into Tasks): Let Value
Dependence of transaction resources (DVtt)p = (ci,cj)2DV, p = 1,2,,
m, i, j21,2,,n and Task Ta2T,a = 1,,k:
Loop (DVtt)p from p = 1 to p = m
Loop Ta from a = 1 to a = k
if ci 2 Tacj2Tado nothing and break
else if ci 2 Tacj Taput tj into Ca and break
else if ci Tacj2Taput ti into Ca and break
else a = a + 1
if a = k + 1create a new Tk + 1, put ci and cj into TK + 1 and set
k=k+1
p=p+1

Denition 8. (Operations): Let O be the set of the operations processed by functions in each task, where OpTpL.

Order every commands in Ta ascending.

For example, let us examine the sales-to-delivery cycle of SAP R/3
SD, which includes two tasks. Table 4 combines the database schema
and database log of the two tasks, which includes ID, operation, table,

An operation is a physical work which is performed by logical unit of

the process.

Table 4
Database log for the sales-to-delivery cycle of SAP R/3 SD.
ID

Operation

Table

PK

Value

C1
C2

UPDATE
INSERT

MARA
VBAK

C3

INSERT

VBAP

MATNR
VBELN
VBELN
POSNR

FERT001
7394
7394
01

C4
C5
C6
C7
C8

C9
C10
C11
C12

C13

INSERT
INSERT
INSERT
INSERT
INSERT

UPDATE
INSERT
INSERT
INSERT

INSERT

VBAP
VBAK
VBAP
LIKP
LIPS

VBAK
VBAP
LIKP
LIPS

LIPS

VBELN
POSNR
VBELN
VBELN
POSNR
VBELN
VBELN
POSNR

VBELN
VBELN
POSNR
VBELN
VBELN
POSNR

VBELN
POSNR

7394
02
9501
9501
01
800311
800311
01

9501
9501
01
800312
800312
01

800312
02

FK

Value

Transaction ID
0000:000f331
0000:000f332

VBAK.VBELN

7394

MARA.MATNR
VBAK.VBELN

FERT001
7394

MARA.MATNR

FERT002

VBAK.VBELN

9501

MARA.MATNR

FERT001

LIKP.VBELN

800311

VBAP.VBELN
VBAP.POSNR

9501
01

VBAK.VBELN

9501

MARA.MATNR

FERT001

LIKP.VBELN

800312

VBAP.VBELN
VBAP.POSNR
LIKP.VBELN

7394
01
800312

VBAP.VBELN
VBAP.POSNR

7394
02

0000:000f332

0000:000f3332
0000:000f3333
0000:000f3333
0000:000f3334
0000:000f3334

0000:000f3335
0000:000f3335
0000:000f3336
0000:000f3336

0000:000f3336

446

S.-M. Huang et al. / Decision Support Systems 47 (2009) 436454

Fig. 8. Relationship between database log, tasks, and operations.

Denition8 formulizes the operations in each task. To group DML

commands into each operation, this study adopts the term Transaction
ID. The DML commands which are performed by the same function will
have the same Transaction ID. According to the Transaction ID, each
DML command can be compared and thereby allow us to determine
whether to group them into one operation or not. Algorithm2 proceeds
to group DML commands into each operation in one task.

The Incidence Matrix I = taij b and entry of it represents the number

of places that the token changed Pj when transition Ti is ring.
And for the Incidence Matrix I, there exists a state equation:
d
P
Md = Md 1 + IT
Uk .
1

Md and Md-1 is the marking of Petri-Net, IT is the transpose matrix

d
P
Uk is an i 1 Transition Firing Matrix
of Incidence Matrix I, and
1

Algorithm 2. (Group DML Commands into Operations): Let ci 2C,

i21,2,,o is the Data Manipulation Language (DML) Commands of a
sorting tasks Ta2T,a = 1,2,,k, TID(c) is a function which maps the
Trancation ID of the DML command c, and Operation Oab2OpTa, b = 1,
is the rst operation of Ta:
Loop Ta from a = 1 to a = k
Loop ci until i N o
if Oab = ()put ci into Oab and set TID(Oab) = TID(ci)
else if TID(ci) = TID(Oab) and ciOabput ci into Oab
else if TID(ci) = TID(Oab) and ci2Oabdo nothing
elsecreate new Oa(b + 1), set b = b+ 1,
put ci into the new Oab and set TID(Oab) = TID(ci)
i=i+1
a=a+1
Fig. 8 illustrates the relationship between the log, tasks, and operations.
According to algorithm2, the DML commands can be grouped into each
operation. T1=(C2, C3, C4, C11, C12, C13) will become T1={O11 (C2, C3),
O12 (C11, C12)}, and T2=(C5, C6, C7, C8, C9, C10) will become T2={O21
(C5, C6), O22(C7, C8), O23(C9, C10)}. It is now feasible to analyze the
operations in each task by employing the analysis mechanism.
3.3. Phase3: business process gap analysis
The nal phase of the mechanism is business process gap analysis.
The mathematical analysis properties of the mathematical model are
used to test the IS process ow. This research uses the Incidence
Matrix and State Equation of the Petri-Net to test the business process
gap between the IS process ow and the internal control ow.

which indicates the number of times transition Ti res.

The reachability analysis of Petri-Net is conducted according to the
matrix algebra and can be calculated by using the following steps:
1. Let r be the rank of IT.
2. Adjusting IT and the corresponding Md and Md 1,d = 1,2,,n, let the upper left
quadrant of IT being a nonsingular square matrix of order r.


I
I
3. Decomposing IT to the form IT = 11 12 , let I11 be the nonsingular square matrix
I21 I22


M1
where M = (Md
of order r, and decomposes the corresponding M =
M2
Md 1).
4. Now

d
P

"
Uk =

1
1
I11
M1 I11
I12 K

#
, where K = [K1,,Ki r]T.

5. Set 0 K1,,Ki r 1 and calculate all possible

d
P

Uk .

d
P

Uk = U1 ; N ; Ud is the sum

of the ring sequence. Let Mk + 1 = Mk + ITUk,M1 = Md 1. If all Uk are nonnegative

integer and can make Mk + 1 N0, i.e. all Uk are reable, Md can reach from Md 1 via the
d
P
Uk = U1 ; N Ud .(This paper sets 0 K1,,Ki r 1 to nd the
d
1
P
minimal ring sequence, if 2 K1 or or Ki r , the Transition Firing Matrix
Uk

ring sequence

only repeats some fraction of the ring sequence.)

Denition9 denes the conformability of the IS process ow and

d
P
Uk calculated from the

the internal control ow. When the

reachability analysis of Petri-Net is a nonnegative integer and reable

solution, it means that Md (the state of post-operation) can reach from
Md 1 (the state of pre-operation) and the operation does not violate
the internal control. The IS process ow should include both the
physical dataow and logical workow. However, the database log
only includes the physical dataow. It is therefore necessary to extend
the physical dataow to the logical workow. This study assumes that

S.-M. Huang et al. / Decision Support Systems 47 (2009) 436454

447

process ow conforms to the internal control ow on operation O12 in

task T1.
Operation O22 in task T2 also conforms like O12 in T1, as well as for
Operation O2. MP(O22) = [0,0,0,0,0,0,0,1,1,0,0,0,0,0,0]T, M(P(O22)) =
[ 0 , 0 , 0 , 0 , 0 , 0 , 0 ,1,1,1,1, 0 , 0 , 0 , 0 ] T, a n d M ( P ( O 2 3 ) ) =
d
P
Uk = 0; 1 2K2 ; 1; 0; 0;
[0,0,0,0,0,1,1,0,0,0,0,0,0,0,1] T.
1
d
P
Uk can
K2 ; K2 ; 1; 1; 1 + K1 ; 1 K1 ; K1 2K2 ; K2 ; 1; 1; K1 ; K2 T 

if operation Oab is scanned in the database log, the input transition of

Oab must have been red and tokens should have been put into all
output places of the input transition (include all resources of dataow,
events, functions, and connectors of workow).
Denition 9. (Conformability): Oab2OpTa,b = 1,2,,q,a = 1,2,,k
and MOab2mN(eEPC),
d
P
I t(M(P(Oa(b + 1)))(M(P(Oab))+MP(Oab))) = Uk exists nonnega1
d
P
tive integer solution Uk and every Uk is reable

then be calculated to reveal that a nonnegative integer solution does

not exist. Therefore, the IS process ow does not conform to the
internal control ow on operation O23 in task T2.
According to the adjusted Petri-Net, this study maintains that
operation O22 (C7,C8) is processed by CREATE DELIVERY and O23 (C9,
C10) is processed by CHANGE SALES ORDER DOCUMENT. An analysis
report will identify that in task T2 (VBAK.VBELN (which means Sales
Order): 9501) the post-operation O23 (CHANGE SALES ORDER
DOCUMENT) after the pre-operation O22 (CREATE DELIVERY) has a
business process gap and the system will experience a control failure.
Auditors then need to dene why the business process gap exists and
formulate an audit report of the IS.

information system process ow conforms to the internal

control owon operation Oa(b + 1) in task Ta.
mN (eEPC) is the modied Petri Net of the standard procedure.
It is the transpose Incidence Matrix of mN (eEPC).
Oab is the operation processed by function of the task Ta in database
log.
P(Oab) is the function which maps operation Oab's places in mN
(eEPC).
MP(Oab) is the corresponding marking of operation Oab's places, and
M(P(Oab)) is the corresponding marking of all output places from
places P(Oab)'s input transition in mN (eEPC).

4. Mechanism development

Table 5 is the adjusting Incidence Matrix of Fig. 7 whose upper left

quadrant is a nonsingular square matrix.

This research constructs a Business Process Gap Detecting Mechanism (BPGAP-Detecting Mechanism) system to implement the business
process gap detection. The BPGAP-Detecting Mechanism system is
developed based on the environment of Microsoft .NET and the
Microsoft SQL Server. This study separates functions of the BPGAPDetecting Mechanism system into six fundamental libraries such as
abstraction, encapsulation, polymorphism, and inheritance of the
object-oriented model to take advantage of the inherent strengths.
Therefore, the eEPC can be replaced by other dynamic modeling tools,
such as UML (Unied Modeling Language), without rewriting the
algorithm of the gap detecting mechanism.
In addition to the six libraries of the BPGAP-Detecting Mechanism
system, this study employed the third party software Lumigent Log
Explorer [32] to provide the assistance in extracting the database log.
This study requires the use of Lumigent Log Explorer because Microsoft
SQL Server does not provide any open protocol to access its database log.
The log explorer software can be used to read and export the database

3.4. A numerical example

Table 6 is the transposed Incidence Matrix of the adjusted Petri-Net
for the book-to-billing cycle in SAP R/3 SD. Table 7 is the adjusted
matrix of Table 6, whose upper left quadrant is a nonsingular square
matrix. For the task T1 = {O1 (C2, C3), O12 (C11, C12)}, this study
determined that: MP(O11) = [0,0,0,1,1,0,0,0,0,0,0,0,0,0,0]T, M(P(O11)) =
[0,0,0,1,1,0,0,0,0,0,0,0,0,1,0] T, and M (P (O12)) = [0,0,0,0,0,0,0,
1,1,1,1,0,0,0,0]T.
d
P
Given this knowledge,
Uk = 0; 2k2 ; 1; 1; 1; k2 ; k2 ; 0; 0; k1 ;
1
d
P
1k1 ; k1 2k2 ; k2 ; 0; 0; k1 ; k2 T can thereby be calculated and Uk =
1

0; 0; 1; 1; 1; 0; 0; 0; 0; 0; 1; 0; 0; 0; 0; 0; 0 K1 = 0 and K2 = 0 is revealed
to be a nonnegative integer and reable solution. Therefore, the IS

Table 5
The adjusted transpose incidence matrix of the adjusted Petri-Net.
PLACES/TRANSITIONS
CREATE SALES ORDER
CHANGE SALES ORDER
CREATED DELIVERY
INSERT VBAK
INSERT VBAP
UPDATE VBAK
UPDATE VBAP
INSERT LIKP
INSERT LIPS
VBAK
VBAP
LIKP
LIPS
XOR_1
XOR_2

A1
1
0
0
1
1
0
0
0
0
0
0
0
0
1
0

A2
0
1
0
0
0
1
1
0
0
1
1
0
0
0
1

A3
0
0
1
0
0
0
0
1
1
0
0
0
0
0
0

A4
0
0
0
2
0
0
0
0
0
1
0
0
0
0
0

A5
0
0
0
0
2
0
0
0
0
0
1
0
0
0
0

A6
0
0
0
0
0
2
0
0
0
1
0
0
0
0
0

A7
0
0
0
0
0
0
2
0
0
0
1
0
0
0
0

A8
0
0
0
0
0
0
0
2
0
0
0
1
0
0
0

A9
0
0
0
0
0
0
0
0
2
0
0
0
1
0
0

A10
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0

A11
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0

A12
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1

A14
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0

A16
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0

A17
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0

A13
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1

A15
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0

Note
A1:
A2:
A3:
A4:
A5:
A6:

NEW SALES ORDER

MODIFY SALES ORDER
NEW DELIVERY
INSERT VBAK
INSERT VBAP
UPDATE VBAK

A7: UPDATE VBAP

A8: INSERT LIKP
A9: INSERT LIPS
A10: XOR_1_1
A11: XOR_1_2
A12: XOR_2_1

A13: XOR_2_2
A14: VBAK_UNCONCERNED
A15: VBAP_UNCONCERNED
A16: LIKP_UNCONCERNED
A17: LIPS_UNCONCERNED

448

Table 6
The transpose incidence matrix of the adjusted Petri-Net.
The transpose Incidence Matrix of the modied Petri Net
PLACES\TRANSITIONS

A1

A2

A3

A4

A5

A6

A7

A8

A9

A10

A11

A12

A13

A14

A15

A16

A17

A18

A19

A20

A21

A22

A23

A24

A25

A26

A27

A28

A29

A30

A31

A32

A33

A34

A35

A36

A37

A38

A39

0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
1
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0

1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0

1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0

0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0

0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0

0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0

0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0

0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0

0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0

0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1

0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0

Note
A1: NEW SALES ORDER
A2: MODIFY SALES ORDER
A3: NEW DELIVERY
A4: MODIFY DELIVERY
A5: NEW BILLING DOC.
A6: MODIFY BILLING DOC.

A7: DELETE BILLING DOC.

A8: INSERT VBAK
A9: INSERT VBAP
A10: UPDATE VBAK
A11: UPDATE VBAP
A12: INSERT LIKP

A13: INSERT LIPS

A14: UPDATE LIKP
A15: UPDATE LIPS
A16: INSERT VBRK
A17: INSERT VBRP
A18: UPDATE VBRK

A19: UPDATE VBRP

A20: DELETE VBRK
A21: DELETE VBRP
A22: XOR_1_1
A23: XOR_1_2
A24: XOR_2_1

A25: XOR_2_2
A26: XOR_3_1
A27: XOR_3_2
A28: XOR_4_1
A29: XOR_4_2
A30: XOR_5_1

A31: XOR_5_2
A32: XOR_6_1
A33: XOR_6_2
A34: VBAK_UNCONCERNED
A35: VBAP_UNCONCERNED
A36: LIKP_UNCONCERNED

A37: LIPS_UNCONCERNED
A38: VBRK_UNCONCERNED
A39: VBRP_UNCONCERNED

S.-M. Huang et al. / Decision Support Systems 47 (2009) 436454

CREATE SALES
1
0
0
0
0
0
0
0
0
0
ORDER
CHANGE SALES
0 1
0
0
0
0
0
0
0
0
ORDER
CREATE DELIVERY
0
0 1
0
0
0
0
0
0
0
CHANGE DELIVERY
0
0
0 1
0
0
0
0
0
0
CREATE BILLING DOC.
0
0
0
0 1
0
0
0
0
0
CHANGE BILLING DOC. 0
0
0
0
0 1
0
0
0
0
CANCEL BILLING DOC. 0
0
0
0
0
0 1
0
0
0
INSERT VBAK
1
0
0
0
0
0
0 2
0
0
INSERT VBAP
1
0
0
0
0
0
0
0 2
0
UPDATE VBAK
0
1
0
0
0
0
0
0
0 2
UPDATE VBAP
0
1
0
0
0
0
0
0
0
0
INSERT LIKP
0
0
1
0
0
0
0
0
0
0
INSERT LIPS
0
0
1
0
0
0
0
0
0
0
UPDATE LIKP
0
0
0
1
0
0
0
0
0
0
UPDATE LIPS
0
0
0
1
0
0
0
0
0
0
INSERT VBRK
0
0
0
0
1
0
0
0
0
0
INSERT VBRP
0
0
0
0
1
0
0
0
0
0
UPDATE VBRK
0
0
0
0
0
1
0
0
0
0
UPDATE VBRP
0
0
0
0
0
1
0
0
0
0
DELETE VBRK
0
0
0
0
0
0
1
0
0
0
DELETE VBRP
0
0
0
0
0
0
1
0
0
0
VBAK
0 1
0
0
0
0
0
1
0
1
VBAP
0 1
0
0
0
0
0
0
1
0
LIKP
0
0
0 1
0
0
0
0
0
0
LIPS
0
0
0 1
0
0
0
0
0
0
VBRK
0
0
0
0
0 1 1
0
0
0
VBRP
0
0
0
0
0 1 1
0
0
0
XOR_1
1
0
0
0
0
0
0
0
0
0
XOR_2
0
1
0
0
0
0
0
0
0
0
XOR_3
0
0
1
0
0
0
0
0
0
0
XOR_4
0
0
0
1
0
0
0
0
0
0
XOR_5
0
0
0
0
1
0
0
0
0
0
XOR_6
0
0
0
0
0
1
0
0
0
0

Table 7
The adjusted transpose incidence matrix of the adjusted Petri-Net.
The adjusting transpose Incidence Matrix of the modied Petri Net
PLACES\TRANSITIONS

A1

A2

A3

A4

A5

A6

A7

A8

A9

A10

A11

A12

A13

A14

A15

A16

A17

A18

A19

A20

A21

A22

A23

A24

A26

A27

A28

A30

A31

A32

A34

A36

A38

A25

A29

A33

A35

A37

A39

0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
1
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0

1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0

0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0

0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0

0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0

0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0

0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0

0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0

1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0

0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0

0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0

S.-M. Huang et al. / Decision Support Systems 47 (2009) 436454

CREATE SALES
1
0
0
0
0
0
0
0
0
0
ORDER
CHANGE SALES
0 1
0
0
0
0
0
0
0
0
ORDER
CREATE DELIVERY
0
0 1
0
0
0
0
0
0
0
CHANGE DELIVERY
0
0
0 1
0
0
0
0
0
0
CREATE BILLING DOC. 0
0
0
0 1
0
0
0
0
0
CHANGE BILLING DOC. 0
0
0
0
0 1
0
0
0
0
CANCEL BILLING DOC. 0
0
0
0
0
0 1
0
0
0
INSERT VBAK
1
0
0
0
0
0
0 2
0
0
INSERT VBAP
1
0
0
0
0
0
0
0 2
0
UPDATE VBAK
0
1
0
0
0
0
0
0
0 2
UPDATE VBAP
0
1
0
0
0
0
0
0
0
0
INSERT LIKP
0
0
1
0
0
0
0
0
0
0
INSERT LIPS
0
0
1
0
0
0
0
0
0
0
UPDATE LIKP
0
0
0
1
0
0
0
0
0
0
UPDATE LIPS
0
0
0
1
0
0
0
0
0
0
INSERT VBRK
0
0
0
0
1
0
0
0
0
0
INSERT VBRP
0
0
0
0
1
0
0
0
0
0
UPDATE VBRK
0
0
0
0
0
1
0
0
0
0
UPDATE VBRP
0
0
0
0
0
1
0
0
0
0
DELETE VBRK
0
0
0
0
0
0
1
0
0
0
DELETE VBRP
0
0
0
0
0
0
1
0
0
0
VBAK
0 1
0
0
0
0
0
1
0
1
0
0
0
0
0
0
1
0
VBAP
0 1
LIKP
0
0
0 1
0
0
0
0
0
0
LIPS
0
0
0 1
0
0
0
0
0
0
VBRK
0
0
0
0
0 1 1
0
0
0
VBRP
0
0
0
0
0 1 1
0
0
0
XOR_1
1
0
0
0
0
0
0
0
0
0
XOR_2
0
1
0
0
0
0
0
0
0
0
XOR_3
0
0
1
0
0
0
0
0
0
0
XOR_4
0
0
0
1
0
0
0
0
0
0
XOR_5
0
0
0
0
1
0
0
0
0
0
XOR_6
0
0
0
0
0
1
0
0
0
0
Note
A1: NEW SALES ORDER
A2: MODIFY SALES ORDER
A3: NEW DELIVERY
A4: MODIFY DELIVERY
A5: NEW BILLING DOC.
A6: MODIFY BILLING DOC.

A7: DELETE BILLING DOC.

A8: INSERT VBAK
A9: INSERT VBAP
A10: UPDATE VBAK
A11: UPDATE VBAP
A12: INSERT LIKP

A13: INSERT LIPS

A14: UPDATE LIKP
A15: UPDATE LIPS
A16: INSERT VBRK
A17: INSERT VBRP
A18: UPDATE VBRK

A19: UPDATE VBRP

A20: DELETE VBRK
A21: DELETE VBRP
A22: XOR_1_1
A23: XOR_1_2
A24: XOR_2_1

A25: XOR_2_2
A26: XOR_3_1
A27: XOR_3_2
A28: XOR_4_1
A29: XOR_4_2
A30: XOR_5_1

A31: XOR_5_2
A32: XOR_6_1
A33: XOR_6_2
A34: VBAK_UNCONCERNED
A35: VBAP_UNCONCERNED
A36: LIKP_UNCONCERNED

A37: LIPS_UNCONCERNED
A38: VBRK_UNCONCERNED
A39: VBRP_UNCONCERNED

449

450

S.-M. Huang et al. / Decision Support Systems 47 (2009) 436454

log. Protection of the database log is needed to avoid human modication

of the database's tracking system. Fig. 9 is the extracted screen of part of
the BPGAP-Detecting Mechanism system, whose statistical results are
depicted using a pie chart following the business process gap analysis.
5. Mechanism evaluation
In order to verify the proposed system based on the BPGAPDetecting Mechanism, this study employs a real case to illustrate how
the BPGAP-Detecting Mechanism works. The case company examined
is an ISO (International Organization for Standardization) 9001
quality assured industrial company: K Company. K Company is a
trading company and specializes in exporting hand tools, air tools and
automotive specialty tools. K Company has 55812 types of items with
an operational amount of approximately two million US dollars a year.
There are four departments in K Company: sales, stock management,
delivery, and nance. The company has about two thousands
customers in China, Hong Kong, Australia and across Europe. It has a
good reputation among its customers and has processed many
successful orders of Original Equipment Manufacturer (OEM) from
customers. The company uses a good deal of IS and therefore is
applicable for our study's purposes.
5.1. Case study methodology
The business process gap detecting mechanism in our research is a
new eld within the CAATTs. There is little related literature on this
subject and therefore the mechanism lacks signicant quantitative
indexes with which to compare it. Case study methodology can assist
us in solving this problem.
Case study methodology is a common qualitative method used in
IS evaluations [4,22]. It is an empirical inquiry that investigates a

contemporary phenomenon within its real-life context, especially

when the boundaries between phenomenon and context are not
clearly evident [55]. The business process gap detecting mechanism
tests the control of the IS. The result of it (i.e. business process gap)
needs to be explained in terms of why and how that result was
attained. Case study methodology matches this need as it can assist
the researcher in analyzing the case and proposing the reasons (why)
and the processes (how) of the phenomenon.
This study uses a single-case study type to evaluate the business
process gap detecting mechanism, which includes more depth than a
multiple-case study [55]. The control failures of the IS are not always
accessible. However, once the phenomenon exists in the single case, it
can determine the correctness of the business process gap detecting
mechanism. It should be noted that every IS has the opportunity to
experience control failure. This case can be representative of other
companies' IS situations.
5.2. Data quality problems of the case company
In order to improve their competitiveness, K Company decided to
replace their ERP system. Although the new ERP system was
implemented mid-year, K Company uncovered a data quality problem.
In fact, some users responded that in the ORD (Order) module, sales
orders still contained incomplete data items after these orders were
transferred into purchase orders. In this scenario, the user passes the
sales order: AST-040601 at Step1. After the sales order converts to a
purchase order, the item: KC-A13370 is automatically deleted in the
sales order: AST-040601.
K Company does not know why this error occurs, as some sales
orders are correct while others are incorrect with no identiable
pattern to explain the phenomenon. The company urgently needs to
improve the data quality of their ERP system, and a computer audit

Fig. 9. Screen of the BPGAP-detecting mechanism system.

S.-M. Huang et al. / Decision Support Systems 47 (2009) 436454

451

project is subsequently announced to examine their IS to determine

the reason for the data quality problem. The authors joined the
computer audit project as the IT auditor. The project is based on two
testing phases:
Phase1: The substantive test by using the Generalized Audit Software (GAS).
Phase2: The control test by using the BPGAP-Detecting Mechanism system.

5.3. The substantive test by using the Generalized Audit Software (GAS)
First, this paper extracts the data of the ORD module between 2006/
012006/02 for analysis. The Generalized Audit Software (GAS) ACL is
used to nd the items lost within sales orders when purchase orders
were transferred from sales orders. This paper found that there were 132
lost items distributed on 54 sales orders in this month. The total duration
of the test was about one hour.
This study group proposed the substantive result to K Company
and met to communicate the result. Four sales department users who
were involved in the ORD module attended the meeting, which lasted
approximately one hour. This study summarizes some crucial points
from the dialogue between IT auditors and users in the following:
1. Every item in the purchase orders should have a mapping item in
the sales orders.
2. Account control of the ERP system is satisfactory, as other
departments lack permission to modify the sales order. Therefore,
the data quality problem should be traced to the sales department.
3. The ERP system does not show any error message about the data
quality problem.
4. There is no pattern of the data quality problem.
5. Users did not delete any item of the sales orders during our sample
date.
5.4. The control test by using the BPGAP-detecting mechanism system
It is easy to nd data quality problems via the substantive test of
Generalized Audit Software (GAS). However, for deeper analysis to
know how the data quality problem happened, this study utilized
the control test of the BPGAP-Detecting Mechanism system.
First, the BPGAP-Detecting Mechanism system is used to depict
the internal control ow of the ORD module. The ERP vendor
documents the internal control ow of the ORD module. The ERP
vendor then uses the eEPC diagram to depict their systems, from
which the eEPC diagram of the internal control ow can be easily
attained. Because the BPGAP-Detecting Mechanism system also
contains the notations of the eEPC, it is easy for us to depict the eEPC
diagram in the BPGAP-Detecting Mechanism system. Second, the
workow and dataow models can be mapped to the mathematical
model Petri-Net. Third, the Lumigent Log Explorer software is used
to assist us in extracting the database log of the ORD module. Since
the total log of the ORD module is very large, this paper only extracts
INSERT, UPDATE and DELETE commands between 2006/01/01 ~
2006/01/31 of the log. After exporting the log to the database, the
stored procedure of the Resource and Value Dependence Method
was performed. The nal step is to conduct a business process gap
analysis. The reachability analysis of Petri-Net will calculate all
possible paths according to the database log and test the correctness
of the paths. After performing the business process gap analysis,
statistical results can be depicted with a pie chart. It is intriguing that
98 (9.4%) IS process ows are erroneous out of 1048 (100%) total IS
process ows. Four IS process ows violate the internal control ows
and they are:
1. Pass sales to PO (Purchase Order) modify sales order. (51)
2. Modify sales order new stock quantity. (44)

Fig. 10. Scenario detected after the control test of the data quality problem.

3. Modify PO modify sales order. (1)

4. Pass sales to PO new delivery. (2)
The rst two IS process ows are in the majority.
This study proposed the control test result to K Company and met
to discuss the result. Since the control test of the IS tests the IS process
ow, the meeting is attended not only by the users of the sales
department but also by the programmer, who has just recently been
placed in charge of the ORD module.
After the communication of the control test result, K Company now
knows the data quality problem is not caused by passing the sales
order into a purchase order, but is in fact caused by the modifying
action conducted after the pass action. However, the internal control
ow tells us that modifying action could not take place after the pass
action. This study communicated this aw.
After discussion, this study nds that the data quality problem is
caused by nonstandard actions taken by the end users. This can
happen as a result of a change management aw of the ERP vender.
The content and information related to the user satisfaction regarding
interaction between users and auditors can be summarized below:
1. The data quality problem is caused by the erroneous information
process ow: pass sales to PO (Purchase Order) modify sales
order. Since the added item will replace the original one after the
sales order passes to a purchase order, it can create the illusion
that sales orders lost items after they pass to purchase orders.
Fig. 10 depicts the scenario of the error. The user starts to pass the
sales order: AST-040601 to purchase orders at step1. Then the user
adds a new item: KC-A13694 at Step3 and Step4 for both sales order
and purchase order. However, the new item: KC-A13694 at Step3
will replace the old item: KC-A13370 in the sales order: AST040601. The replacement will create the illusion that sales orders:
AST-040601 deleted item: KC-A13370 after it passed to purchase
orders.
2. The ERP vendor has a aw in their change management of the
software. They should have a change management meeting to
ensure that any change of the software will not endanger the data.
Relevant documents should be updated after any change of the ERP
system.
3. The users and the programmer considered the computer audit
project to be extremely useful for the IS, since the control test of the
IS can provide them with important information.
6. Conclusion
6.1. Research contribution
Computer auditing has become increasingly important with the
popularization of IS. There are various computer-assisted audit

452

S.-M. Huang et al. / Decision Support Systems 47 (2009) 436454

technologies and tools (CAATTs) that can assist the auditor in

acquiring knowledge of IS. However, most of them can only perform
substantive tests. To construct a general system to perform the entire
control test for IS is rather difcult since various IS have different data
structures and IS process ows.
The control test of the IS is essential for ensuring that business
process gaps do not exist between the IS process ow and internal
control ow. In this research, a business process gap detecting
mechanism is provided to detect the business process gap between
the IS process ow and the internal control ow. The business process
gap detecting mechanism transforms the workow and dataow
models (eEPC) of internal control ow into data for the Petri-Net. The
automatic mechanism then uses the reachability analysis of the PetriNet to detect the business process gap. This research constructs the
BPGAP-Detecting Mechanism system in order to implement the
business process gap detecting mechanism and evaluate the feasibility
of our BPGAP-Detecting Mechanism system through a real case. The
result indicates the control test of the BPGAP-Detecting Mechanism
system can uncover the reason for the data quality problem of the case
company and provide helpful information to them.
Although the embedded audit module (EAM), one kind of CAATT,
had been proposed to monitor business process controls, there are
some drawbacks from using this tool [20]. The most signicant reason
is that EAM must be tightly coupled with enterprise systems [5], and it
is difcult to construct a general EAM that can be combined with
diverse enterprise systems. Compared with EAM, the proposed
mechanism, BPGAP-Detecting Mechanism, is more exible and usable
because it is separate from enterprise systems. The BPGAP-Detecting
Mechanism relies on read-only access and the extraction of controls
data from enterprise systems. Therefore, the controls data extracted
by BPGAP-Detecting Mechanism cannot be manipulated by the rm
personnel before or after extraction. In addition, the code and
environment of BPGAP-Detecting Mechanism can be also wellprotected.
This research focused on the capabilities of CAATTs and classies
them into substantive tests and control tests. This study insists that
the substantive test and the control test should complement each
other. The substantive test can detect errors of the data. However, to
know what causes the errors, this study has shown the need to
perform a control test. The automatic mechanism for the control test
in this research improves both audit quality and software quality. The
authors hope this research can guide a new avenue for academic and
practical research about CAATTs.
6.2. Managerial signicance
The assurance of internal controls and improved business
performance demanded by users today are hampered by a contemporary business environment which involves an increasingly copious
volume of data and complex business activities. To overcome these
problems and achieve their business objectives, more and more
rms have begun to take advantage of technology for conducting
internal auditing. The analysis of the business transactions which
underlie complex business processes is the key for successful internal auditing. The proposed mechanism, BPGAP-Detecting Mechanism, can analyze business transactions by detecting business process
gaps between the IS process ow and the internal control ow. The
BPGAP-Detecting Mechanism has a direct managerial implication
for rms and auditors, as rms can be aided in supporting regulatory compliance and detecting the error of business processes
and IS processes, while audit departments also improve audit
productivity.
Today more than ever, rms are being required to comply with
more regulations, such as the SarbanesOxley (SOX) Act, Health
Insurance Portability and Accountability Act (HIPAA), and Basel II
regulations. The cost and complexity of regulations compliance for

rms have continuously grown. Therefore, rms are increasingly

looking to technology for solutions to effectively transform these
burdens of compliance into competitive advantages. The eighth
component of the enterprise risk management (ERM) model of the
Committee of Sponsoring Organizations (COSO) is monitoring business performance. One of key methods of monitoring performance is
Monitor System Activities. The BPGAP-Detecting Mechanism can
detect business process gaps between the IS process ow and the
internal control ow. Consequently, rms can be assisted in complying
with regulations such as SOX, which emphasize the responsibility
of management to require organizations to follow their business
activities carefully.
Erroneous business processes and IS processes can cause rms to
lose revenue, violate regulations, and damage business operations.
These illegal actions violate the internal control before the material
misstatements are generated [40], causing a gap between problem
incidence and problem recognition. For this reason, business and IS
processes should be proactively monitored to uncover any error or
abuse. However, the effective check of business processes and IS
processes is not easy to perform given increasingly voluminous
amounts of data, the complexity and diversity of information systems,
and ongoing changes in business processes. System auditing is still
inadequate for exposing gaps between the IS process ow and the
internal control ow. With the BPGAP-Detecting Mechanism, rms
have an effective solution for gap detection and can thereby uncover
errors within their business IS processes.
The pressure on audit departments to assist rms in compliance is
increasing because of increased audit responsibilities and a general
lack of rm auditing ability. This is exacerbated by the heavy volume
of business data that should be tested and ongoing changed business
transactions that should be governed by different regulations in
today's business environment. Consequently, audit departments are
looking to technology to optimize audit productivity and efciency.
The BPGAP-Detecting Mechanism can directly and rapidly uncover the
reason for IS problems by detecting gaps between the IS process ow
and the internal control ow. Therefore, the audit departments can
audit more productively and efciently by taking advantage of the
BPGAP-Detecting Mechanism.
6.3. Research limitations and future researches
6.3.1. Future research
Since the development of BPGAP-Detecting Mechanism is still in
testing, the algorithm of Petri Net may be improvable. Different
dynamic models may be found to depict the internal control ow and
to create the transformation rules without utilizing the Petri-Net.
6.3.2. Research limitations
Due to the difculty of extracting the logical workow, this study
only uses the physical dataow of the database log and extends it to
the logical workow. However, the extension may have a semantic
conict problem. For instance, if two functions perform the same
actions on the same tables in a database, it is difcult to distinguish
which function performs which command. Tracing the altered
columns can reduce this conict problem. However, the best solution
for the problem is to provide a common structure like Business
Process Execution Language for Web Services [6] for the workow log
of IS. With both logical workow and physical dataow capabilities,
the mechanism can detect the gap between the internal control ow
and IS process ow more precisely.
In addition, this study only creates the place notation in Petri-Net
of the operations which will affect the data (i.e., INSERT, UPDATE,
DELETE). Many DBMS cannot log the SELECT command because one
SELECT command may involve many tables. However, the SELECT
command is important for the access control issue. DBMS should
ideally be able to record the SELECT command. This complete entire

S.-M. Huang et al. / Decision Support Systems 47 (2009) 436454

database log can improve the quality of the business process gap
detecting mechanism.
This study illustrates not only the importance of meta-data such as
transaction log for auditing, but also that the some of the DBMS logs
are insufcient as audit evidence. Thus, we are suggesting that
alterative theories of IS and auditing may be needed to address
important internal control and audit issues.
Acknowledgments
The work presented in this paper has been supported by The
National Science Council, Taiwan, R.O.C, under Grant No. 97-2410-H194-074-MY3. The authors of this research appreciate deeply their
nancial support and encouragement. In addition, the authors wish to
thank Dr. Hartmut Juergen Will for his advice for improvement.
References
[1] W.M.P. van der Aalst, Formalization and verication of event-driven process
chains, Information and Software Technology 41 (10) (1999) 639650.
[2] W.M.P. van der Aalst, Matching observed behavior and modeled behavior: an
approach based on Petri nets and integer programming, Decision Support Systems
42 (3) (2006) 18431859.
[3] W.M.P. van der Aalst, H.A. Reijers, A.J.M.M. Weijters, B.F. van Dongen, A.K. Alves de
Medeiros, M. Song, H.M.W. Verbeek, Business process mining: an industrial
application, Information Systems 32 (5) (2007) 713732.
[4] M. Alavi, P. Carlson, A review of MIS research and disciplinary development,
Journal of Management Information Systems 8 (4) (1992) 4562.
[5] M. Alles, G. Brennan, A. Kogan, M.A. Vasarhelyi, Continuous monitoring of business
process controls: a pilot implementation of a continuous auditing system at
Siemens, International Journal of Accounting Information Systems 7 (2) (2006)
137161.
[6] T. Andrews, F. Curbera, H. Dholakia, Y. Goland, J. Klein, F. Leymann, K. Liu, D. Roller,
D. Smith, S. Thatte, I. Trickovic, S. Weerawarana, Business Process Execution
Language for Web Services, 2003 http://ifr.sap.com/bpel4ws.
[7] C. Badica, A. Badica, V. Litoiu, A new formal IDEF-based modelling of business
processes, Proceedings of the First Balkan Conference in Informatics, 2003.
[8] A.D. Bailey, G.L. Duke, J. Gerlach, C. Ko, R.D. Meservy, A.B. Whinston, TICOM and the
analysis of internal controls, The Accounting Review LX (2) (1985) 186201.
[9] H.G. Baker, Petri nets and languages, Computation Structures Group Memo 68,
(Project MAC, MIT, Cambridge, Mass., 1972).
[10] G. Booch, J. Rumbaugh, I. Jacobson, The Unied Software Development Process,
Addison-Wesley, 1999.
[11] R.L. Braun, H.E. Davis, Computer-assisted audit tools and techniques: analysis and
perspectives, Managerial Auditing Journal 18 (9) (2003) 725731.
[12] J.W. Bryans, M. Koutny, P.Y.A. Ryan, Modeling Opacity Using Petri-Nets, Electronic
Notes in Theoretical Computer Science, vol. 121, 2005, pp. 101115.
[13] J.J. Champlain, Auditing Information Systems 2nd, John Wiley & Sons, 2003.
[14] S. Chan, SarbanesOxley: the IT dimension, The Internal Auditor 61 (1) (2004)
3133.
[15] C.L.Y. Chou, T. Du, V.S. Lai, Continuous auditing with a multi-agent system, Decision
Support Systems 42 (4) (2007) 22742292.
[16] J.A. Christensen, J.R. Byington, The computer: an essential fraud detection tool,
Journal of Corporate Accounting & Finance 14 (5) (2003) 2327.
[17] Computer Security Institute (CSI) and San Francisco Federal Bureau of Investigation's (FBI) Computer Intrusion Squad, 2005 Computer Crime and Security Survey,
2005 http://www.GoCSI.com.
[18] R.J. Daigle, T. Kizirian, L.D. Sneathen Jr., System controls reliability and assessment
effort, International Journal of Auditing 9 (1) (2005) 7990.
[19] S.V. Grabski, S.A. Leech, Complementary controls and ERP implementation success,
International Journal of Accounting Information Systems 8 (1) (2007) 1739.
[20] S.M. Groomer, U.S. Murthy, Continuous auditing of database applications: an
embedded audit module approach, Journal of Information Systems 3 (2) (1989) 5369.
[21] J.H. Harrington, E.K.C. Esseling, H. van Nimwegen, Business process improvement
workbook: documatation, analysis, design, and management of business process
improvement, McGrawHill, New York, 1998.
[22] A.R. Hevner, S.T. March, P. Jinsoo, S. Ram, Design science in information systems
research, MIS Quarterly 28 (1) (2004) 75106.
[23] T. Hoffman, SarbanesOxley sparks forensics apps interest: vendors offer
monitoring tools to help identify incidents of nancial fraud, Computer World
38 (2004).
[24] ISACA Standards Board, Continuous auditing: is it fantasy or reality? Information
System Control Journal 5 (2002) 4346.
[25] Y.C. Juan, C.O. Yang, Systematic approach for the gap analysis of business processes,
International Journal of Production Research 42 (7) (2004) 13251364.
[26] G. Keller, T. Teufel, SAP R/3 Process Oriented Implementation, Addison-Wesley,
1998.
[27] C.H. Kim, D.S. Yim, R.H. Weston, An integrated use of IDEF0, IDEF3 and Petri-Net
methods in support of business process modeling, Journal of Process Mechanical
Engineering 215 (4) (2001) 317329.

453

[28] I. Koch, B.H. Junker, M. Heiner, Application of Petri-Net for modeling and validation
of the sucrose breakdown pathway in the potato tuber, Bioinformatics 21 (7)
(2005) 12191226.
[29] P.T. Lee, K.P. Tan, Modeling of visualised data-ow diagrams using Petri net model,
Software Engineering Journal 7 (1) (1992) 412.
[30] K. Lee, H. Jeong, C. Park, J. Park, Construction and performance analysis of a PetriNet model based on a functional model in a CIM system, International Journal of
Advanced Manufacturing Technology 23 (12) (2004) 139147.
[31] R. Liu, A. Kumar, W. van der Aalst, A formal modeling approach for supply chain
event management, Decision Support Systems 43 (3) (2007) 761778.
[32] Lumigent.com, http://www.lumigent.com/ (2005).
[33] H.K. Meena, I. Saha, J.K. Mondal, T.V. Prabhakar, An approach to workow
modeling and analysis, Proceedings of the Institution of Mechanical Engineers
Part E Journal of Process Mechanical Engineering 215 (4) (2001) 317329.
[34] R.D. Meservy, A.D. Bailey, P.E. Johnson, Internal control evaluation: a computational model of the review process, Auditing: A Journal of Practice & Theory 6 (1)
(1986) 4474.
[35] Microsoft.com, MSDN: Introduction to Transaction Logs, 2005 http://msdn2.
microsoft.com/en-us/library/ms190925.aspx.
[36] J.L. Mooney, H.W. Harrell, S.E. Ludwig, Audit software that helps your company
stop fraud, Journal of Corporate Accounting & Finance 11 (4) (2000) 1723.
[37] T. Murata, Petri-Nets: properties, analysis and applications, Proceedings of the
IEEE 77 (4) (1989) 541580.
[38] Oracle.com, Oracle Database Concepts 10g Release 2 (10.2) B14220-02, 2005
http://download-west.oracle.com/docs/cd/B19306_01/server.102/b14220/toc.htm.
[39] M. Petterson, The keys to effective IT auditing, Journal of Corporate Accounting &
Finance 16 (5) (2005) 4146.
[40] Z. Rezaee, R. Elam, A. Sharbatoghlie, Continuous auditing: the audit of the future,
Managerial Auditing Journal 16 (3) (2001) 150158.
[41] Z. Rezaee, A. Sharbatoghlie, R. Elam, P.L. McMickle, Continuous auditing: building
automated auditing capability, Auditing 21 (1) (2002) 147163.
[42] P. Rob, C. Coronel, Database Systems: Design, Implementation, and Management
6th, Course-Technology, 2004.
[43] M.B. Romney, P.J. Steinbart, Accounting Information Systems 10th, Prentice Hall, 2005.
[44] P. Sarbanes, G. Oxley, SarbanesOxley act of 2002, , 2002.
[45] T. Schattkowsky, UML 2.0 overview and perspectives in SoC design, Proceedings of the
Design, Automation and Test in Europe Conference and Exhibition, 2005, pp. 823833.
[46] A.W. Scheer, Aris - Modellierungsmethoden, Metamodelle, Anwendungen,
Spinger, 2001.
[47] O. Turetke, D. Schuff, R. Sharda, T.T. Ow, Supporting systems analysis and design
through sheye views, Communications of The ACM 47 (9) (2004) 7277.
[48] J.D. Ullman, J.D. Widom, A First Course In Database Systems 2nd, Prentice Hall, 2002.
[49] S.A. White, Business Process Modeling Notation (BPMN) Version 1.0, 2004 http://
BPMI.org.
[50] Wikipedia, Petri net, 2009 http://en.wikipedia.org/wiki/Petri_net.
[51] G.C. Williams, Implementing SAP Sales and Distribution, McGraw Hill, New York,
2000.
[52] J.L. Witten, L.D. Bentley, K.C. Dittman, System Analysis & Design Methods 7th,
McGrawHill, 2005.
[53] S. Wright, A.M. Wright, Information system assurance for enterprise resource
planning systems: unique risk considerations, Journal of Information Systems 16
(1) (2002) 99113.
[54] A.W.L. Yao, H.T. Liao, J.S.C. Chi, S.S. Peng, A Petri-Net based ofine simulation and
online diagnostic platform for manufacturing systems, Journal of Chinese Institute
of Industrial Engineers 22 (1) (2005) 6475.
[55] R.K. Yin, Case Study Research: Design and Methods 3rd, Sage Publications, 2003.
[56] Y.C. Yu, W.H. Chen, K.P. Liu, Integration of EPC and a modularized colored Petri-Net
through events for agile manufacturing cell control, Proceedings of the 2004 IEEE
International Conference on Networking, Sensing & Control, 2004.
[57] American Institute of Certied Public Accountants, Amendment to Statement on
Auditing Standards No. 31, Evidential Matter, Statement on Auditing Standards, No.
80, New York: AICPA (1996).
[58] C.A. Petri, Communication with Automata, Grifss Air Force Base Tech, Report
RADC-TR-65377 1 (1) (1966).

Shi-Ming Huang received his PhD degree at the School of Computing and Information
Systems, University of Sunderland, U.K. He is currently a Professor of Information
Management Department and a Director for the Center of Manufacturing and Commerce
Automation at National Chung Cheng University, Taiwan. Before joining the university faculty,
he was a head and associate professor at the Department of Information Management, Tatung
University, Taiwan. He was also a director of the center for commerce automation at the north
region Taiwan for Ministry of Education, Taiwan. He has published several books and papers
in the elds of information systems and has acted as a consultant for a variety of Taiwan
government departments, software companies and commercial companies.
David C. Yen is currently Jennifer E. Petters Chair in Asia Business and Professors of MIS of the
Department of Decision Sciences and Management Information Systems at Miami University.
He assumed Raymond E. Glos Professor in Business from 20052007 and was a department
chair from 19952005. After receiving his PhD in MIS and MS in Computer Sciences in 1985,
professor Yen is active in research. He has published books and articles which have appeared
in Communications of the ACM, Decision Support Systems, Information & Management,
Information Sciences, Computer Standards and Interfaces, Information Society, Omega,
International Journal of Organizational Computing and Electronic Commerce, and Communications of AIS among others. Professor Yen's research interests include data communications, electronic/mobile commerce, and systems analysis and design.

454

S.-M. Huang et al. / Decision Support Systems 47 (2009) 436454

Yu-Chung Hung is an associate professor of Accounting and Information Technology

Department at National Chung Cheng University, Taiwan, R.O.C. He was awarded his Ph.D.
degree from University of Missouri-Rolla in 1995. His major elds of interest are Information
System Adoption/Implementation/Integration and Knowledge Management. His research
works had appeared in the journals like Decision Support Systems, Journal of Computer
Information Systems, Industrial Management and Data Systems, International Journal of
Computer Applications Technology, International Journal of Advanced Manufacturing
Technology, among others.
Yen-Ju Zhou received the MS degree in the Department of Information Management
from the National Chung-Cheng University. Mr. Zhou's research focuses on ComputerAssisted Audit Techniques and Tools, IT Auditing and IT Governance.

Jing-Shiuan Hua is currently pursuing her PhD in MIS in the Department of Information
Management from the National Chung-Cheng University. She was a member of National
Chung-Cheng University Center for e-Manufacturing and e-Commerce. Ms. Hua
research interest includes data base, web design, and systems analysis and design.