Information system audit and organizational performance: an integrative review of governance, controls, and implementation
Keywords:
Information system audit, IT governance, internal control, IT controls, ; audit effectiveness, organizational performanceAbstract
Information system auditing has become a strategic assurance activity as organizations increasingly depend on digital systems for financial reporting, operational processes, managerial decision-making, and risk management. Although prior studies generally associate information technology (IT) governance, IT controls, internal auditing, and organizational capabilities with performance outcomes, the literature remains fragmented regarding the mechanisms through which information system audit activities generate organizational value. This study develops an integrative review of peer-reviewed literature to explain how information system audit effectiveness can contribute to organizational performance. The review synthesizes evidence across four mechanisms: information reliability and security, internal control and risk management, IT governance and strategic alignment, and implementation of audit recommendations. Evidence from empirical and conceptual studies indicates that audit effectiveness is better understood as an organizational process than as a stand-alone assurance output. IT governance capability can improve IT performance and subsequently business performance; weaknesses in IT internal controls are associated with adverse performance consequences; and internal-audit IT knowledge and competencies strengthen IT governance processes and IT controls. The review further identifies management support, board-level IT competence, governance maturity, and organizational readiness as important enabling conditions. On this basis, the study proposes an implementation-centered framework in which audit effectiveness influences organizational performance through governance and control mechanisms, with implementation acting as a critical transmission channel. The contribution of this study is to integrate information system auditing with accounting information systems and IT governance research and to specify mechanisms and boundary conditions that can be tested in future empirical studies.
References
Alkalbani, A., Deng, H., & Kam, B. (2016). Investigating the role of socio-organizational factors in information security compliance in organizations. International Journal of Information Management, 36(6), 947–957.
Benaroch, M. (2025). Measuring the pervasiveness of IT general controls: A model and empirical validation. International Journal of Accounting Information Systems, 56, 100752. https://doi.org/10.1016/j.accinf.2025.100752
Bharadwaj, A. S. (2000). A resource-based perspective on information technology capability and firm performance: An empirical investigation. MIS Quarterly, 24(1), 169–196.
Caluwe, L., Wilkin, C. L., De Haes, S., & Huygh, T. (2024). Board roles required for IT governance to become an integral component of corporate governance. International Journal of Accounting Information Systems, 54, 100694. https://doi.org/10.1016/j.accinf.2024.100694
De Haes, S., & Van Grembergen, W. (2009). An exploratory study into IT governance implementations and its impact on business/IT alignment. Information Systems Management, 26(2), 123–137. https://doi.org/10.1080/10580530902794786
De Haes, S., Van Grembergen, W., Joshi, A., & Huygh, T. (2019). Enterprise governance of information technology: Achieving alignment and value in digital organizations. Springer. https://doi.org/10.1007/978-3-030-25918-1
De Haes, S., & Van Grembergen, W. (2009). Enterprise governance of information technology: Achieving strategic alignment and value. Springer. https://doi.org/10.1007/978-0-387-84882-2
Hamdan, A., Khamis, R., Anasweh, M., Al-Hashimi, M., & Razzaque, A. (2019). IT governance and firm performance: Empirical study from Saudi Arabia. SAGE Open, 9(2). https://doi.org/10.1177/2158244019843721
Hall, J. A. (2021). Accounting information systems (10th ed.). Cengage.
Ilmudeen, A. (2024). IT governance mechanism and IT-enabled dynamic capabilities drives firm performance: An empirical study in Sri Lanka. Information Development, 40(1), 3–19. https://doi.org/10.1177/02666669221074259
ISACA. (2019). COBIT 2019 framework: Governance and management objectives. ISACA.
Li, C., Lim, J.-H., & Wang, Q. (2008). Internal and external influences on IT control governance. International Journal of Accounting Information Systems, 9(4), 225–239. https://doi.org/10.1016/j.accinf.2007.09.002
Lunardi, G. L., Becker, J. L., Maçada, A. C. G., & Dolci, P. C. (2014). The impact of adopting IT governance on financial performance: An empirical analysis among Brazilian firms. International Journal of Accounting Information Systems, 15(1), 66–81. https://doi.org/10.1016/j.accinf.2013.02.001
Melville, N., Kraemer, K., & Gurbaxani, V. (2004). Information technology and organizational performance: An integrative model of IT business value. MIS Quarterly, 28(2), 283–322.
Page, M. J., McKenzie, J. E., Bossuyt, P. M., Boutron, I., Hoffmann, T. C., Mulrow, C. D., et al. (2021). The PRISMA 2020 statement: An updated guideline for reporting systematic reviews. BMJ, 372, n71. https://doi.org/10.1136/bmj.n71
Pereira, C. M. L., da Silva, M. M., & de Carvalho, J. Á. (2022). Impact of IT governance process capability on business performance: Theory and empirical evidence. Decision Support Systems, 153, 113668. https://doi.org/10.1016/j.dss.2021.113668
Permatasari, Y. (2025). The influence of IT governance implementation on firm performance in manufacturing companies. Journal of Applied Accounting and Taxation, 10(1), 1–11. https://doi.org/10.30871/jaat.v10i1.7020
Peterson, R. (2004). Crafting information technology governance. Information Systems Management, 21(4), 7–22. https://doi.org/10.1201/1078/44705.21.4.20040901/84183.2
Plant, O. H., van Hillegersberg, J., & Aldea, A. (2022). Rethinking IT governance: Designing a framework for mitigating risk and fostering internal control in a DevOps environment. International Journal of Accounting Information Systems, 45, 100560. https://doi.org/10.1016/j.accinf.2022.100560
Sambamurthy, V., & Zmud, R. W. (1999). Arrangements for information technology governance: A theory of multiple contingencies. MIS Quarterly, 23(2), 261–290.
Saragih, A. H., Ali, S., Suwardi, E., & Utomo, H. (2024). Finding the missing pieces to an optimal corporate tax savings: Information technology governance and internal information quality. International Journal of Accounting Information Systems, 52, 100665. https://doi.org/10.1016/j.accinf.2023.100665
Shi, W., & Zhang, Z. (2025). Exploring the role of digital governance: The effect of audit digitalization on firms’ internal control weaknesses in China. International Journal of Accounting Information Systems, 56, 100756. https://doi.org/10.1016/j.accinf.2025.100756
Snyder, H. (2019). Literature review as a research methodology: An overview and guidelines. Journal of Business Research, 104, 333–339. https://doi.org/10.1016/j.jbusres.2019.07.039
Stoel, M. D., & Muhanna, W. A. (2011). IT internal control weaknesses and firm performance: An organizational liability lens. International Journal of Accounting Information Systems, 12(4), 280–304. https://doi.org/10.1016/j.accinf.2011.06.001
Tranfield, D., Denyer, D., & Smart, P. (2003). Towards a methodology for developing evidence-informed management knowledge by means of systematic review. British Journal of Management, 14(3), 207–222. https://doi.org/10.1111/1467-8551.00375
Turel, O., Liu, P., & Bart, C. (2019). Is board IT governance a silver bullet? A capability complementarity and shaping view. International Journal of Accounting Information Systems, 33, 32–46. https://doi.org/10.1016/j.accinf.2019.03.002
Tuttle, B., & Vandervelde, S. D. (2007). An empirical examination of CobiT as an internal control framework for information technology. International Journal of Accounting Information Systems, 8(4), 240–263. https://doi.org/10.1016/j.accinf.2007.09.001
Van Grembergen, W., De Haes, S., & Guldentops, E. (2004). Structures, processes and relational mechanisms for IT governance. In W. Van Grembergen (Ed.), Strategies for information technology governance (pp. 1–36). IGI Global. https://doi.org/10.4018/978-1-59140-140-7.ch001
Weill, P., & Ross, J. W. (2004). IT governance: How top performers manage IT decision rights for superior results. Harvard Business School Press.
Wu, T.-H., Huang, S.-Y., Chiu, A.-A., & Yen, D. C. (2024). IT governance and IT controls: Analysis from an internal auditing perspective. International Journal of Accounting Information Systems, 52, 100663. https://doi.org/10.1016/j.accinf.2023.100663
Zhang, P., Zhao, K., & Kumar, R. (2016). Impact of IT governance and IT capability on firm performance. Information Systems Management, 33(4), 291–302. https://doi.org/10.1080/10580530.2016.1220218.
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Umi Devina, Turni Azizah (Author)
This work is licensed under a Creative Commons Attribution 4.0 International License.
Authors retain copyright and grant the journal the right of first publication. All articles published in this journal are licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0), which permits use, distribution, reproduction, and adaptation in any medium, provided that appropriate credit is given to the original author(s) and the source.
ISSN
