PROPOSED ANALYTICAL PROCEDURE FOR THE CUSTOMIZATION AND IMPLEMENTATION OF COBIT 5, AN AUDITING TOOL: AN ACTION DESIGN RESEARCH APPROACH

Customization is part of an audit planning exercise that addresses the issue of implementation of a broad audit framework for the achievement of the most desired audit outcomes for the audit client. Leading frameworks such as Control OBjectives for Information and related Technology (COBIT) that have successfully been used as an audit framework have changed focus from audit to complex governance and management framework, leaving audit professionals with the challenge to figure out how to configure it into an auditing tool. The framers of COBIT 5 recommend to Information Technology (IT) auditors to apply professional judgment, experience, and IT skills for the customization of the framework for their desired audit goals. This, however, has been controversial in theory and cumbersome in practice and no solution has yet been found for the problem. In this research, we use an Action Design Research approach to design a model for performing objective customization of COBIT 5 for better outcomes as the solution. We found that the Viable Systems Model’s Indices from the cybernetics science paradigm and the Process Assessment Model were relevant to achieve this goal. The resulting solution designed provides a more efficient, teachable, and simpler technique in the selection of substantive procedures for desired audit outcomes. The model can be very cost effective, save audit time, and reduce audit failure exposure.