Keywords:

Fraud Risk Judgment, Audit Technology, Task Structure, Task-Technology Fit

Introduction

Fraud risk judgment is one of the main types of judgment developed to unearth potential fraud in an organisation. According to the International Standard of Auditing (ISA) 240, fraud detection is not the auditors’ primary responsibility when auditing accounts. The notion of professional skepticism is an inherent part of their job when they are conducting an audit and being alert to the possibilities of fraud. Likewise, government auditors in the public sector are also responsible for undertaking fraud risk tasks as required by the law, regulations or mandates (International Organization of Supreme Audit Institutions (INTOSAI), 2009; National Audit Department of Malaysia, 2007). An ineffective fraud risk judgment would compromise the ability of the government to deliver effective services to the public. An effective fraud risk judgment can prevent potential losses due to fraud and allow the identification of activities vulnerable to fraud risk. Therefore, immediate action to rectify the outcomes of a fraud risk judgment will mitigate the risk (Bakri et al., 2017; Haron et al., 2015; Zager et al., 2016).

Auditors often use their judgment when performing a fraud risk judgment. Auditors’ judgment is subjective and the differences in judgment may be due to the possibility of inaccuracies, inconsistencies or lack of consensus among auditors when undertaking a fraud risk judgment; these issues reflect the poor performance of auditors’ fraud risk judgments (Sanusi et al., 2018). Substandard performance in the fraud risk judgment will inevitably arouse questions from the public on the auditors’ inability to detect fraud (Brazel et al., 2015). However, the public seems to ignore the fact that there are other factors possibly impairing the auditors’ ability to detect a fraud risk task such as pressures of time, complex situations, uncertain environment and difficulties in obtaining clear and correct answers (Braun, 2000). Auditors are allowing exercising their discretion according to the nature and timing of fraud risk judgment when forming opinions related to fraud risk. Furthermore, tasks, environment, and individuals cause the problems in audit judgments (King, 2020). For this reason, it is vital for auditors to do their fraud risk judgment work in a high-quality way.

Fraud risk judgment involves a few processes, and the recent advances in information technology allow auditors to obtain audit evidence from various sources. Auditors can gather fraud risk information from multiple sources which range from financial data to non-financial data (Dastjerdi et al., 2019; Trotman & Wright, 2012). With the availability of both forms of data, auditors may use technology to examine the data and subsequently make an informed professional judgment (Smidt et al., 2019). In the auditing profession, information technology has revolutionized the auditing process and replaced traditional auditing methods. Audit technology now greatly assists auditors and especially in fraud risk judgment. Employing audit technology in fraud risk judgment will make an important difference to the success of fraud detection. Task structure may also affect the fraud risk judgment by auditors even though they are equipped with the relevant technology. This study examines the impact of audit technology and task structure on the performance of fraud risk judgment by Malaysian government auditors in public sector procurement activities.

Auditors’ performance and judgment are affected by various types of tasks (Duh et al., 2018; Mohd Sanusi et al., 2018). Audit technology might improve risk assessment and the auditors’ judgment. However, audit technology may not be immediately feasible for a certain type of task due to the nature and level of its complexity. Thus, understanding the type of task would help to identify the level of audit technology that matches the type of task for a successful audit judgment task (Kogan et al., 2018). In other words, failure to match the appropriate audit technology to the type of task may affect auditors’ judgment (Duh et al., 2006; Goodhue & Thompson, 1995). Prior studies have focused on the effect of technology on audit judgment independently and help explain how technology can improve auditors’ detection of fraud (Alles et al., 2018a). However, minimal studies have focused on audit technology and task characteristics in performing of fraud risk judgment.

This study aims to examine the direct and interactional effects of audit technology and task structure on Malaysian government auditors’ fraud risk judgment in public sector procurement activities. This study contributes to the literature in several ways. First, even though previous studies have found that auditors often accept technology, they are still reluctant to use it in their duties (Janvrin et al., 2008). Most organisations rely upon ‘traditional audit’ methods, which is all routine audit tasks can be accomplished via the audit technology (Vasarhelyi et al., 2012). Second, this study provides an understanding of the Task-Technology Fit (TTF) theory in the context of the fraud risk judgment of Malaysian government auditors. By using this theory in the fraud risk task of public sector procurement, this study seeks to explain the relationship between task characteristics, audit technology and performance. TTF theory contributes to the auditing literature since most studies have examined the acceptance and utilization of audit technology using other theories, for example: Technology Acceptance Model (TAM) or Unified Technology Acceptance and Use of Technology (UTAUT) (Bierstaker et al., 2014; Gonzalez et al., 2012; Janvrin et al., 2009). The remainder of this paper is structured as follows. First, it offers a literature review on fraud risk tasks and audit technology. Second, it explains the research methodology and third, it discusses the analysis results. Fourth and finally, it provides a conclusion on the main themes covered here.

Literature Review

Fraud Risk Judgment

The fraud auditing guidelines involved in public sector auditing govern the processes of fraud risk tasks. There are six important stages in this process, namely: (1) preliminary analysis, (2) identification of fraud indicators, (3) analysis of gathered information, (4) investigations, (5) documentation, and (6) reporting (National Audit Department of Malaysia, 2007). The fraud risk task is vital to the government sector since it is a greatly affected area (Association of Certified Fraud Examiners (ACFE), 2020). Government auditors should pay more attention to each stage in the fraud risk task. In the current technological environment, most of the government’s work processes are automated, and data are stored digitally in databases or search engines. The use of a traditional method is no longer effective for government auditors in a preliminary analysis of fraud risk in an information technology-rich environment. These auditors need to use the appropriate technology that will ensure a successful fraud risk task process and outcome (Curtis & Payne, 2008). The fraud auditing guidelines should emphasize the use of audit technology in detail at every stage of the fraud risk judgment.

The time factor is often a primary constraint for government auditors engaged in fraud risk tasks and checking accounting cycles and other matters (Braun, 2000; Lee, 2012). Now audit technological advances have made it possible to conduct fraud risk tasks automatically. For example, Alles, et al., (2018b) used audit technology in testing internal controls in a multinational company. They identified a few necessary steps to reengineering before automating the tests of controls tasks using audit technology in what are known as System, Application and Product (SAP) environments. They also suggested the use of General Audit Software (GAS) to automate the tests of control. Audit technology has the ability to automate the fraud risk task. Indeed, an understanding of audit technology suitability with the fraud risk task will increase more audit technology usage (Kogan et al., 2018). However, audit technology is still very much developing, and caught between the ‘traditional auditing’ and ‘low’ levels (Vasarhelyi et al., 2012). Therefore, understanding the process of fraud risk judgment in public sector procurement is needed before automating the fraud risk judgment at all accounting cycles using audit technology.

The public sector guidelines of fraud risk judgment serve the Malaysian government auditors in executing fraud risk judgments. Following the previously noted six stages in the fraud risk judgment, each stage sets out in detail the goal of improving the performance of fraud risk judgment. In the preliminary analysis stage, government auditors are encouraged to brainstorm the situation, getting data from various sources and using the technology for data analysis. The use of audit technology in a preliminary analysis is feasible (Alles et al., 2018a). The failure of preliminary analysis may lead to a failure in detecting and mitigating fraud risk (Norman et al., 2010; Zahari et al., 2021). Therefore, the preliminary analysis of fraud risk is a crucial stage of the fraud risk judgment.

While e-Procurement is a modern government initiative for widening information technology usage, it helps to improve public service delivery and government officials’ accountability. However, the integrity of the public sector procurement process is in question due to the large amount of waste occurring (Shu Hui et al., 2011; Zahari et al., 2021). Buang (2008) has noted that procurement activities are high-risk activities in the Malaysian public sector. The wastage in procurement may be due to the result of a failure to detect fraud risk during financial statement auditing. Consequently, a fraud risk judgment in each procurement method is essential to use audit technology.

Fraud risk may occur at any stage of procurement and the fraud risk judgment should have carried out at any procurement phase. Various mechanisms were established to monitor public sector procurement such as instructions to the internal auditor of the relevant ministry to monitor procurement reports. The introduction of e-Procurement is expected to reduce but not eliminate fraud risk. It should be noted that the procurement monitoring mechanism alone is not sufficient to ensure compliance with policies and procedures (Shu Hui et al., 2011). Procurement monitoring by reviewing a hard copy of the report is not sufficient for auditors to assess fraud risk in the public sector. Therefore, the use of audit technology has the potential to help procurement monitoring (Jans et al., 2010). Shifting from manual to e-Procurement makes it possible for auditors to change their approach in fraud risk judgments (Kogan et al., 2010, 2018; Wu et al., 2008).

Potential of Audit Technology in Fraud Risk Task

Implementation of audit technology in the public sector is feasible because most e-government initiatives were implemented using Enterprise Resource Planning (ERP) which is an essential prerequisite for audit technology implementation (Alles et al., 2006; Vasarhelyi et al., 2018). Nevertheless, not all systems use ERP since these systems are still using the legacy system. Diversity in the system may be one of the contributing factors to the low usage of audit technology due to a lack of understanding of how to implement audit technology. Implementation it in the public sector is feasible provided there the audit technology is properly monitored.

Automated techniques help auditors to perform a fraud risk judgment and improve their performance (Alles et al., 2018a; Kuhn & Sutton, 2006). For example, Kuhn and Sutton (2006) demonstrated how the historical financial data is used for a test of control using audit technology to determine fraud. Alles, et al., (2018a) conducted such a test using audit technology on live systems. Apart from the test of control, it is possible for substantive tests to employ an audit technology approach because it has the potential for automation. The substantive test automation such as cluster analysis, Continuity Equation (CE) or logistic regression has the potential to assess fraud risk from the data. For example, Kogan, et al., (2010) proposed the use of CE in audit technology. However, there are limitations in performing a substantive test using audit technology because it involves a less-structured task. For this reason, the audit procedure needs some modifications before substantive test automation is conducted. The auditing literature lacks studies that examine the interaction between audit technology and task type in regard to fraud risk judgment.

The use of audit technology may improve auditing and the performance of fraud risk judgment (Curtis & Payne, 2008; Janvrin et al., 2008). ISA 240 suggested that auditors could use Computer-Assisted Audit Tools and Techniques (CAATTs) in auditing and fraud risk tasks. The use of audit technology in a fraud risk tasks would not only improve the fraud risk judgment but also reduces auditing costs and hence, benefit the organisation that is facing a constraints-resources problem (Chan & Vasarhelyi, 2018; Rezaee et al., 2001). The use of audit technology allows auditors to examine the entire financial data and then sort the financial data with specific characteristics and finally, automate the fraud risk judgment (Kogan et al., 2018). For example, fraudsters might approve several payments to themselves without being detected by traditional auditing due to the use of sampling. With the use of audit technology, fraud risk might detect wrongdoing because the high payment data is being audited. Arguably, government auditors should intensify their use of audit technology while doing a fraud risk judgment as this will subsequently improve the performance. Unfortunately, public sector fraud auditing guidelines do not emphasize the use of audit technology in a fraud risk judgment.

Hypothesis Development

Although studies have shown that technology will improve audit performance, the usage is not widespread (Ahmi & Kent, 2013; Bierstaker et al., 2014; Curtis & Payne, 2014; Janvrin et al., 2008). Most organisations are still in the ‘traditional audit’ or ‘low’ stage of having audit technology (Pennington et al., 2006; Vasarhelyi et al., 2012). A large group of studies have focused on the acceptance of audit technology from the behavioral perspective such as perceived usefulness, perceived ease of use, performance expectancy, effort expectancy and social factors (Bierstaker et al., 2014; Curtis & Payne, 2008; Kim et al., 2009; Vasarhelyi et al., 2012; Venkatesh et al., 2003). However, less focus was placed on the suitability of audit technology to a given task (Aljukhadar et al., 2014; Junglas et al., 2008; Shirani et al., 1999). It is necessary to have a balanced focus on the suitability of the audit technology and a fraud risk judgment.

The audit technology needs to be understood prior to using it in fraud risk tasks. The capabilities of audit technology vary from combining the manual and automated methods to artificial intelligence models. With rapid advances being made in audit technology capabilities, auditors should focus more on judgment tasks when performing a fraud risk judgment by transferring routine tasks to the audit technology. However, to do this it is necessary to understand the effects of different audit technologies on fraud risk judgment. Therefore, the first hypothesis is to understand the effect of audit technology on the performance of fraud risk judgment.

H1 Audit technology has a positive direct effect on the performance of fraud risk judgment of public sector procurement.

Task structure involves clarity of information and identifying the steps needed to achieve task objectives. Specifically, structured tasks are tasks that have defined steps and clear information so that the task can be completed effectively. In contrast, a less structured task does not have clear steps on how to perform the task. The less structured task demands more professional judgment from government auditors in deciding the best option available to them (Duh et al., 2006; Kerr, 2013). In a fraud risk task, the types of test available are classified as structured, less structured or unstructured tasks. Government auditors need to follow internal controls established by those in charge of governance matters when performing the test of control. Here, the test of control is a structured task while a substantive test becomes a semi-structured one in the public sector since it is governed by official guidelines (Kerr, 2013; Liu et al., 2011). Perhaps a task structure does wield an impact on fraud risk judgment since prior studies have shown that task complexity can influence audit judgment (Mascha & Miller, 2010; Mohd-Sanusi et al., 2018). Therefore, the second hypothesis seeks to understand the effect of task structure on the performance of fraud risk judgment.

H2 Task structure has a positive direct effect on the performance of fraud risk judgment of public sector procurement.

Government auditors perform various tasks in the fraud risk judgment such as a test of control and a substantive test. These are two types of tests that have different task characteristics. The task characteristic explains the behavior of the information (Kim & Soergel, 2006). The task characteristic is an attribute of every workflow item, and it can influence auditors’ judgment (Libby & Luft, 1993; Murphy, 1994). Advances in audit technology enable auditors to focus more on the judgment task when performing a fraud risk judgment by transferring routine tasks to audit technology. Not all tasks are suitable for audit technology here because some tasks still require judgment and professional skepticism from auditors. However, to transfer a routine task to the audit technology, it is important to understand how audit technology and tasks complement each other. Since only a few studies have examined the suitability of audit technology to fraud risk tasks, it is vital to comprehend how appropriate audit technology actually is. Hence, the following hypothesis is posited here:

H3 The interaction between audit technology and task structure influences the performance of fraud risk judgment of public sector procurement.

Methodology

A research experimental design is used in this study to answer the research questions. Task structure is chosen as within subject because participants can perform both structured and less structured tasks. In practice, government auditors need to evaluate the internal controls before they can start the financial statement auditing. Those charged with governance matters in the organisation design the internal controls and auditors evaluate these internal controls. Half of the participants who are involved in the mixed factorial experiment worked with either a high or a low level of audit technology. By using a mixed factor experimental design, the number of participants was reduced to a manageable level so that the administration of data collection could be effective and efficient.

Participants and Data Collection

There are approximately 2,784 Malaysian government internal and external auditors for various ministries and departments. Government auditors who participated in this study were selected and put into either one of the two condition groups at random. The appropriate sample size was based on the total population and the dependent variable scale whether in the form of categorical or continuous data. Since the dependent variable in this study is measured using continuous data, calculations of sample size for continuous data are applied. Based on a significance level or an alpha level of 0.05, the appropriate sample size for this study is 112 government auditors (Bartlett et al., 2001). The target for each condition group is at least 80 auditors resulting in 160 government auditors who were identified. The response rate overall was 94%. Out of the 151 auditors who participated in this study, 47 (31.1%) were men and 104 (68.9%) were women. In the public sector, government auditors can also work as external auditors, internal auditors or perform administrative tasks due to the demands of job rotation.

Research Instrument

The research instrument comprises a cover letter and a research booklet. The cover letter provides a brief description of the study and the experiment exercise that the participants need to complete. The research booklet consists of two parts, namely, the fraud risk judgment in part one and the descriptive information of participants in part two. Results of the analyses using Audit Command Language (ACL) show the transaction has violated the internal control procedure and the transaction related to improper payment. Participants were assigned to two groups, namely, high or low level of audit technology. In addition to the research booklets, the participants were also provided with a laptop containing ACL and data related to the first and second tasks.

Evaluation of internal controls is one of the most important tasks for which auditors need to form an opinion. Testing of controls is an audit procedure designed to evaluate the effectiveness of internal controls in preventing, detecting and correcting any material misstatement at the assertion level (ISA 330). Internal control is a first line of deterrence against a fraud. The substantive test can help to conduct a fraud risk judgment (Kogan et al., 2010; Kuhn Jr. & Sutton, 2006) and can be automated using audit technology (Alles et al., 2018; Li, Huang & Lin, 2007). The purpose of the substantive test of transactions in the fraud risk judgment is to identify a fraud risk in the transaction, which requires an immediate corrective action to prevent it. For example, Kogan, et al., (2010) advanced the notion of the substantive test by using the CE and found that the substantive test of transactions could identify anomalies in their testing data set. In the enterprise system environment, the substantive test and tests of controls must complement each other so that fraud risk can be prevented and/or stopped. Therefore, the first task is a fraud risk judgment using the tests of controls while the second task is a fraud risk judgment using substantive test for transactions.

Measurement

The fraud risk judgment performance was measured by the percentage of correct responses to the fraud risk judgment (Mohd-Sanusi & Mohd-Iskandar, 2007; Mohd-Sanusi et al., 2018). Records of payments were modified from the real data as transactions with fraud risk. The predetermined answer for the first task contained ten records of payments and the second task contained 20 records of payments with the likelihood of fraud. By performing real tasks, the rating of overestimation or underestimation of performance in the judgment could avoid. Participants received scores based on the percentage of correct responses on the likelihood of fraud in the structured and less-structured task. The fraud risk judgment was calculated based on the correct responses on the likelihood of fraud transaction divided by the predetermined likelihood of fraud transaction and convert to a percentage.

The audit technology used in this study was a high and low level of audit technology, which functioned as a manipulation tool in a between-subject variable in the experiments. It is more feasible to use the high and low level of audit technology as a measurement tool by ignoring the manual because the current technological environment forces auditors to use the technology (Parasuraman & Wickens, 2000; Vasarhelyi et al., 2012). Low level of audit technology involved with human intervention up to certain degrees. While high level was defined as no human intervention and fully controlled by the system. Further, less literature is available on automation of continuous audit technology. Task structure is an alternative to the actions and sequences required for completing the task (Abdolmohammadi, 1999). Task structure is a within-subject manipulation for the experiment in which participants need to perform the structured and less structured tasks. Tests of control are classified as a structured task because of the clarity of task, and the fewer options in performing a task will require less judgment to complete it (Duh et al., 2006). Therefore, structured and less structured tasks are used to measure the task.

Analysis

Descriptive Analysis

Table 1 shows a mean score for the performance of fraud risk judgment in the structured and less structured tasks. The mean score for the performance of fraud risk judgment in the structured task is 64.83 while a less structured task achieves a mean score of 49.57, resulting in a mean score difference of 15.26. Overall, each condition group in the structured task scored higher compared with the less structured task in all condition groups. In a high level of audit technology group, the mean score regarding the performance of fraud risk judgment in the structured task is 70.00 while for the less structured task the mean score of 47.79 was arrived at. In a low level of audit technology group, the mean score for the performance of fraud risk judgment in the structured task is 59.46 and for the less structured task, the mean score is 51.42. To sum up, government auditors perform much better in structured tasks compared to less structured tasks.

Table 1 Descriptive Statistics For The Performance Of Fraud Risk Judgment
Dependent variables	Mean (SD)
	Overall	High Level	Low Level
	N=151	N=77	N=74
Fraud risk judgment in the structured task.	64.83	70	59.46
	-32.452	-30.694	-33.552
Fraud risk judgment in the less structured task.	49.57	47.79	51.42
	-29.922	-30.049	-29.88

Manipulation Check

Participants were divided into two groups, namely, the high and low level of audit technology. As shown in Table 2, the results show a significant difference at the 5% level (p=0.000). Such a result indicates that participants perceived audit technology as a high level when the ACL with scripts was made available. However, when the scripts were not made available, they perceived that the audit technology as a low level. In the second question, participants perceived audit technology as a high level when it was easy to use when scripts became available. Although the participants in the low level group were given an instruction to perform analysis use the ACL, they still considered the audit technology as a low level. The result shows a significant difference at the 5% level (p=0.000) for the second question. For the third question, there was a significant difference at the 5% level (p=0.000). Participants in the high level of audit technology group considered the audit technology as a high level when only minimal technical skills were needed. Meanwhile, participants in the low level group considered the audit technology as a low level when technical skills were required. All three audit technology manipulation questions have a substantial difference answer between groups receiving high and low level of audit technology. Therefore, audit technology manipulation check as between subjects is a success.

Table 2 Manipulation Check For Level Of Audit Technology
Manipulation question	Mean			t	Sig (2-tailed)
	Low Level	High Level	Different
Whether participants perceived ACL is automated/semi-automated when a script/instruction was made available.	2.11	3.34	-1.23	-10.454	0
Whether participants perceived ACL easy to use when a script/instruction was made available.	2.03	3.39	-1.363	-10.637	0
Whether participants perceived a minimal technical skill used to operate ACL when a script/instruction was made available.	2.14	3.38	-1.241	-9.696	0

Result Analysis

The government auditors were exposed to two types of task structure conditions since this study involves within-subject variables. Participants in the experiment received two types of fraud risk judgments, namely, fraud risk judgment in the structured task and a less-structured task. The audit technology was between subject, and participants were only exposed to one of the two audit technology levels, either the high or the low level of audit technology. Seventy-seven (51.0%) participants did the fraud risk judgment using an ACL with a script embedded as a surrogate to the high level of audit technology. Seventy-four (49.0%) participants performed a fraud risk judgment using an ACL with the instructions to do an analysis that was used as a surrogate for the low level of audit technology. Multivariate analysis of variance was used for analysis and answering the research questions.

The Direct Effect of Audit Technology on the Performance of Fraud Risk Judgment

The high and low levels of audit technology are two types of audit technology manipulation. Table 3 shows that the performance of fraud risk judgment has a statistically significant difference at 5% when using such technology in different ways (Wilks' Lambda=0.967; F (2,148)=0.490; p=0.043, one-tailed). Separation of the fraud risk judgment between structured task and less-structured task indicates that audit technology in the structured task reached statistical significance (F(1,149)=4.062; p=0.023, one-tailed). Meanwhile, the fraud risk judgment using audit technology in the less structured task did not attain a statistically significant difference (F(1,149)=0.553; p=0.229, one-tailed). Hypothesis 1 predicts that different levels of audit technology provide a significant positive effect on the performance of fraud risk judgment. Therefore, hypothesis one is supported.

Participants in a high level of audit technology group did the performance of fraud risk judgment better when it was a structured task (M=70.00, SD=30.694). This was comparable to the participants in a low level of audit technology group when performing the fraud risk judgment in the structured task (M=59.46, SD=33.552). Conversely, those participants in a low level of audit technology group did better when conducting the fraud risk judgment in the less structured task (M=51.42, SD=29.880). This was also comparable to the participant group using a high level of audit technology in the less structured task (M=47.79, SD=30.049). The mean difference between a performance of fraud risk judgment in the structured task when using the high level and low level of audit technology is 10.54. Meanwhile, the mean difference between a performance of fraud risk judgment in the less structured task when using the high and low level of audit technology is 3.63. Therefore, this study concludes that the different levels of audit technology exert a positive effect on the performance of fraud risk judgment.

Table 3 Get the App