A decision support framework for internal audit prioritization in a rental car company: A combined use between DEA and AHP

Corporate scandals such as those at Tyco, Enron, and WorldCom have caused the decline of public trust in accounting and reporting practices. In response, US passed the Sarbanes Oxley Law (Sarbanes) in 2002, the most important corporate governance law since securities laws in 1930s. Section 302 of Sarbanes mandates corporations to ensure accurate financial disclosure and to take greater financial reporting and control responsibilities. Management is required to make an annual assertion regarding the design and effectiveness of company’s internal controls. Consequently, many internal auditing resources are stretched. The objective of this case study is to develop a multi-criteria decision making aid that can identify the most critical businesses units within a corporation. Using the aid, we can use efficiently and effectively the internal auditing resources. Internal audits determine if the accounting processes and systems are working as intended. It focuses on the reliability of the accounting data and evaluates business through financial, operational, and compliance review. It assesses the risk of asset loss, studies business processes, and identifies opportunities to improve efficiency and effectiveness. This study explores the potential of applying data envelopment analysis (DEA) and analytic hierarchy process (AHP) to determine the business units that need audit. Compared with conventional methods, the proposed combined model incorporates a much wider range of quantitative and qualitative criteria, and provides a more detailed and thorough study. The proposed evaluation framework is comprehensive and flexible and it shows great potential for internal audit prioritization and resource allocation.