E-Commerce Audit Judgment Expertise: Does Expertise in System Change Management and Information Technology Auditing Mediate E-Commerce Audit Judgment Expertise?

Abstract

A global survey of 203 E-commerce auditors was conducted to investigate the perceptions about the potential determinants of expertise in E-commerce audits. We hypothesize and find evidence indicating that information technology and communication expertise are positively related to expertise in E-commerce audit judgment. We also find that system change management expertise and information technology audit expertise mediate this relationship. [PUBLICATION ABSTRACT]

Headnote

A global survey of 203 E-commerce auditors was conducted to investigate the perceptions about the potential determinants of expertise in E-commerce audits. We hypothesize and find evidence indicating that information technology and communication expertise are positively related to expertise in E-commerce audit judgment. We also find that system change management expertise and information technology audit expertise mediate this relationship.

Keywords: E-commerce Audit Judgment, IT Audit, Structural Equations Modeling

(ProQuest: ... denotes formulae omitted.)

1 Introduction

This paper investigates the perceived relationship between information and communication technology expertise and electronic commerce (E-commerce) audit judgment expertise. We also investigated the effects of mediating variables such as systems change management expertise and information technology audit expertise on E-commerce audit judgment expertise.

The study is important because E-commerce has become commonplace in the United States and other countries [66] and because the advances in information and communication technology are facilitating steady growth in E-commerce. E-commerce entities are defined in this paper as those business organizations whose revenues arise significantly from E-commerce operations and whose majority of internal controls are integrated into E- commerce technology-based accounting systems. This growth presents opportunities and challenges to E-commerce auditors because specialized knowledge is needed to perform these audits. As [55] argue, in addition to knowledge of accounting and auditing, an E-commerce auditor must possess knowledge of systems, networks, and data bases. [63] argue that business to business (B2B) E-commerce is particularly challenging for auditors because it spans organizational boundaries that link firms through their collaborative work processes and interlinking transactions. Thus, auditors' requisite knowledge for effective B2B E-commerce audits entails not only the nature of financial transactions and processes, but also the technologies that enable these transactions and processes to occur.

The remainder of this paper is organized in four sections. In section 2, we present a review of the literature leading to our research hypotheses. The research method is presented in section 3, followed by the structural equation modeling methodology to test the research hypotheses in section 4. The final section provides a summary and conclusions from the study.

2 Literature Review and Hypotheses

The audit expertise literature has established that possession of expertise in domain knowledge is a prerequisite for expertise in audit judgment [1] [13] [14]. Domain knowledge includes textbook knowledge, insights from practical problem solving experience, and stories and anecdotes from business cases [61]. We use this basic finding from the literature to develop the research model for the current study as presented in Figure 1. The model posits that B2B E-commerce Audit Judgment Expertise (ECAJE) is associated with the possession of Information and Communication Technology Expertise (ICTE), Information Technology Audit Expertise (ITAE), System Change Management Expertise (SCME), and E-Commerce Audit Judgment Expertise (ECAJE). These indicator variables and their expected relationships with ECAJE are described in the following sections.

Information and Communication Technology Expertise (ICTE)

The auditing literature posits that E-commerce has radically altered audit risk [35] to the point that auditors must have expertise in the domain knowledge of IT and process re-engineering [4] to be able to understand complex E-commerce audit risk factors. For example, auditors must be able to evaluate network applications [31] because electronic exchange of data between firms may result in the absence of source documents, the transaction may be initiated by a trading partner and there may be a bridging application between the two firms that generates transactions. Similarly, auditors must assess the level of E-commerce trust in terms of security risks, privacy issues, and the reliability of E-Commerce processes / transactions.

In summary, the auditing context has been transformed from simple electronic financial records to electronic media such as e-mail and chat messaging. A consequence of this transformation has been a need for continuous auditing and monitoring [2] [18]. Failure to do so may result in elevated audit risk. For example, [49] report that auditors who were reluctant to review and audit IT controls were more likely to produce incomplete reports with undetected financial misstatements. Based on this literature, we expect that Information and Communication Technology Expertise (ICTE) will be positively associated with E-Commerce Audit Judgment Expertise (ECAJE). Thus, the primary hypothesis of our study is:

H1: Information and Communication Technology Expertise (ICTE) is positively related to E-Commerce Audit Judgment Expertise (ECAJE). H1 predicts a direct path from ICTE to ECAJA.

However, as depicted in Figure 1 this path can be through intermediate expertise variables such as Systems Change Management Expertise (SCME) and Information Technology Audit Expertise (ITAE). Specifically, we predict positive relationships between ICTE and SCME (H1a) and ITAE (H1b). This reasoning indicates that ECAJE would also be positively related to SCME (H1c) and ITAE (H1d). Finally, we predict that SCME and ITAE would be positively related (H1e).

The reasons for these relationships are that audits have become computer-based and are increasingly conducted via networked communication technologies. As [22] argue, to conduct effective audits, auditors need the knowledge and experience of distance based auditing technologies. For example, [21] study of enterprise resource planning (ERP) systems expertise showed that auditors' ERP systems expertise was related to their training in technology systems. Similarly, [12] found that B2B E-commerce auditors needed to understand the work processes at the intra-firm and inter-firm levels. COBIT also requires expertise in system and network change control and management for E-commerce audits6F. COBIT is a framework designed by the Information Systems Audit and Control Association (ISACA) and the IT Governance Institute, USA. Interested readers can look for further details on Control Objectives for Information and Related Technology (COBIT) on the ISACA website.

In summary, B2B E-commerce audits have become increasingly more challenging [33], requiring IT audit expertise to perform these audits. Such expertise should lessen "the risk that the auditor may unknowingly fail to appropriately modify his opinion on financial statements that are materially misstated" [19] [20] [43]. For example, continuous auditing may allow real time identification and reduction of risk [44].

3 Research Method

Variables

The ICTE variable is a proxy for the depth and breadth of knowledge, training, and experience for the auditor in E-commerce audits. Internet, extranet, and intranets are designed and devised on various communication network platforms with different layers of security [29] [47]. E-commerce auditing requires a relatively high level of understanding of information technologies for an auditor [24] [25] [26] [45] [67]. An important focus for the auditor is advanced computer systems training in B2B audit techniques [27]. Wide ranging experience, training and skills in information technologies has a positive influence on the B2B E-commerce auditors' expertise in information and communication technology (ICT) [8] [32] [62]. Familiarity with the best practices followed in different environments regarding computing and networking helps auditors to render effective judgments [11] [30] [34] [40]. From this literature we identified the following four indicator variables for inclusion in the task instrument for this study:

* ICTE1 - the degree of expertise of the auditor in advanced computer systems concepts, methods, technologies and tools.

* ICTE2 - the degree of expertise of the auditor in application systems development.

* ICTE3 - the degree of expertise of the auditor in various operating systems concepts.

* ICTE4 - the depth of experience, training and skills of the auditor in operating systems programming tasks.

Systems Change Management Expertise (SCME) indicates the depth and breadth of knowledge and training in systems and network change management and in security vulnerabilities of client and partner organizations [9] [11] [30]. The B2B E-commerce environment is highly technology centric and changes are often necessary to increase the overall productivity of the processes [34] with change management being one of the most important controls an auditor can assess in a complex accounting information systems environment. Effective change management is also concerned with regulatory governance as described in the global technology audit guideline document of the Institute of Internal Auditors [64]. In a well managed environment, system and network monitors recognize unauthorized or inappropriate changes immediately because they violate the environment's "signature" or normal processing balances and thresholds [53] [56]. From this discussion we identified the following two indicator variables for inclusion in the task instrument:

SCME1 The degree of expertise of the auditor in B2B E-commerce systems and in network change management.

SCME2 The degree of expertise of the auditor in intrusion detection, prevention and management procedures.

Information Technology Audit Expertise (ITAE) covers an auditor's expertise in the technical details of computers, networks, security, and auditing [8] [11] [21] [51]. We identified two indicator variables to assess the level of ITAE as follows:

* ITAE1 - the degree of expertise the auditor has in the use of information systems auditing tools, techniques and methodologies.

* ITAE2 - the degree of expertise the auditor has in auditing and review of E-commerce websites.

* Finally, E-commerce Audit Judgment Expertise (ECAJE) is the variable that indicates an auditor's expertise in planning audits, managing audit engagements, and making judgments regarding the audit [19] [48] [58]. E-Commerce audits require expertise in computing technology related judgments including database management, networking, data communications [28] and auditing judgment including security issues. We identified three indicator variables to measure ECAJE as follows:

* ECAJE1 - the extent of auditor's knowledge and training in evaluation of the relevance and materiality of planning in E-commerce auditing.

* ECAJE2 - the extent of auditor's skill and training in establishing a proper mix to ensure that the expertise required for conducting an E-commerce audit is included in the audit team.

* ECAJE3 - the extent of training and experience in understanding the importance of the long term context of the technical audit decisions taken in the short term.

Task Instrument

To construct the research instrument, the indicator variables identified above were pretested using the Q-sorting methodology [50]. Q-sorting technique helps researchers in identifying a priori the potential understanding of instrument questions. Here either an expert panel or a group of potential respondents were provided the information about the constructs and the items that the construct were to identify. This exercise substantially improves the content validity a priori of these instrument items, where new indicator variables had to be developed. Given the limited empirical work done in the area of E-commerce auditing, we used the Q-sorting technique to define the theorized construct. A panel that consisted of senior accounting majors who had cooperative (internship) and/or full time audit experience in Big-4 audit firms performed the Q-sort8F. The North-American city from which students were drawn has major branches of several manufacturing companies that are heavily into B2B E-commerce activities. We had five students assist in the pre-test of this survey. They did so in consultation with professional E-commerce auditors who were their supervisors during cooperative period. The pretest verified the proposed survey indicator variables. The final set of questions was administered to practicing E-commerce auditors using a web-based survey hosted by the first author's university with the web link available from October 1, 2005 until December 31, 2005. The final questionnaire consisted of 38 variables, of which the indicator variables identified earlier were related to the topic of this paper. The instrument consisted of a cover page with a formal request for participation, followed by a page describing B2B E-commerce audits scenario and demographic information. Respondents were instructed to use a five-point Likert scale (strongly disagree to strongly agree) to assess each indicator variable in the questionnaire and the overall ECAJE. A recommended method of measuring response bias (see [3]) is a comparison of early responses with late responses (as proxy for non-respondents). Accordingly, we compared the early responses (80%) to the late responses. No significant non response-bias was found.

Participants

The American Institute of Certified Public Accountant (AICPA), the Canadian Institute of Chartered Accountants (CICA), the Institute of Chartered Accountants of England & Wales (ICAEW), the Institute of Chartered Accountants of Australia (ICAA), and the Information Systems Audit and Control Association (ISACA) were contacted to request participation in the study. Senior management at the five professional bodies was personally contacted since their audit members have been involved in E-commerce audit in general and B2B audit in particular. AICPA & CICA are extremely active in this E-commerce audit work. These bodies used e-mails/news letters to spread the word amongst its memberships. We asked for auditors who were professionally involved as B2B E-commerce auditors. To encourage participation, we also sent e-mails to 25 offices of "Big-4 Accounting Firms" in major cities in Europe, North America, Asia, and Australia to seek their encouragement of their professional E-commerce auditors to participate in the study.

Overall, 203 usable responses were received that provided ample sample size for data analysis of these responses, 39.90 percent (56.15 percent) had undergraduate (graduate) degrees. The exact response rate could not be determined because participation requests were sent through various channels. We received 212 responses altogether, nine of which responses could not be used due to missing data, leaving 203 useable responses. Missing value imputations were done by indirect method using the linear regression method. This method uses missing data as dependent variable and completed data as predictors. This approach provides for greater variability with some loss/restriction on variance in comparison to other methods [23] [57] [68]. The remaining 3.95 percent had other degrees or did not specify. The average age of the sample was 39.67 years with mean B2B E-commerce audit experience exceeding six years (ranging from 0-20 years). The number of E-commerce audits conducted by the sample was quite significant, averaging 6.61 (range: 0-150) in the year 2000 or earlier and 28.11 after 2000 (range: 0-246). The significance of year 2000 is that many businesses opted for B2B E-commerce beginning in early 2000s. While over one-half of the respondents practiced in the United States and Canada, the rest practiced in other nations, such as the UK (n = 10), Japan (n = 20) or South Africa (n = 3). To assess the validity of considering the sample as one set of respondents, pair-wise T-tests were used between the North American and respondents from other countries (see Table 1).

These comparisons revealed no significant differences between the two groups with only one exception. The indicator variable "Extent of your skill and training at establishing a proper mix to ensure that the expertise required for conducting an E-commerce audit is included in the audit team" indicated a lower mean value (3.74) for North American countries as compared with other countries (4.18). While we acknowledge this difference, based on the fact that the remaining 10 indicator variables were not different, we use the entire sample as a homogeneous group for data analysis.

Two hundred and one respondents reported training in information technology (IT) audits; and 98 percent of those respondents were holding certification awarded by the ISACA or similar agencies in their respective country.

4 Results

Structural equation modeling was used to investigate the relationship of the specific indicator variable to their intended latent variables (i.e., ICTE, SCME, ITAE, and ECAJE). Two assumptions of structural equation modeling using maximum likelihood estimation are multivariate normality and model identification or determinacy [59]. Examination of plots of the indicator variables showed that they were distributed normally and the bivariate scatter plots were linear and homoscedastic. Also as reported in Table 2, examination of the inter-correlations between indicator variables did not reveal multicollinearity.

Structural equation modeling (SEM) was used to assess the degree to which indicator variables loaded on the theorized latent variables. As recommended by [6] and [36], each latent variable was modeled first in isolation, then in pairs, and as a collective network. This method of evaluation has an advantage of achieving the fullest evidence of efficacy of the measurement model and reduces potential confounding to a greater extent in the composite structural equation modeling. The Analysis of Moments Of Sample (AMOS) of SPSS (v14 r14.0.0) was used as the analytical tool to test statistical assumptions and the estimation of the measurement and structural equation models described in the paper. Partial Least Square-Graph (PLS-Graph) version 03 was also used to identify individual t-values, and composite factor reliability (ρc) for the individual constructs.

Confirmatory factor analysis was used to establish the validity and consistency of the eleven indicator variables in terms of the four theorized latent variables.

The maximum likelihood estimations of loadings (using oblique rotation criterion to extract factors with eigen values >=1) and variance extracted are shown in Table 3 and Figure 2. Further, comparing the reliability and quality measures for the constructs and indicator variables with the recommended minimum values, we find that the recommended minimum values are met or exceeded. We therefore conclude that our factors reliably reflect the constructs within the structural equation model.

Table 3 shows the maximum likelihood estimations of the loadings and the variance extracted from each indicator variable. The measures for global model fit included in Figure 2 suggest that the covariance structure model fits the underlying data quite well. The values for the goodness-of-fit index (GFI), adjusted goodness-of-fit index (AGFI), and Normed fit index (NFI), Comparative Fit Index (CFI) clearly exceed the recommended minimum value of 0.9 [10] [16]. The root mean square residual value of 0.05 is also good. The global fit indexes and the normed Chi-square were greater than 0.9 and less than 5 (in our Model, it is 2.20), respectively. Individual constructs were tested to establish discriminant validity of each dimension as shown in Table 4.

The Cronbach alpha coefficient for each construct, respectively in figure 2 is >0.7 as suggested by [52]. Table 4 lists various measures to identify the discriminant validity of each construct used in the research (figure 2) and the results establish discriminant validity for the constructs used in the model. Table 4 also presents the inter-construct correlations and the composite reliability measures for each construct in the model.

The fit measures were found to be extremely good except for the diagnostic indices for two of the indicator variables (ECAJE2 and ICTE1) that were above five which meant that measurement errors were correlated in some way. These indicator variables are highlighted in Table 3. Consequently, we drop these two indicator variables from the original 11-variable model to construct a refined model with only nine variables. The refined model is shown with its maximum likelihood standardized estimates of inter-construct correlations in figure 3.

The nine-indicator variable model in figure 3 has a normalized Chi-square value of 2.76, and its global fit indexes are superior to the earlier model with eleven indicators. The goodness of fit (GFI) index is 0.943 and the comparative fit index is 0.96. The root mean square residual is 0.045 which is also smaller than the original model in figure 2.

Comparison of the two alternative models is shown in the Table 5. As [7] suggests model comparison is easily done by comparing the root mean square residual values of the models. The RMR (root mean square residual) is the square root of the average squared amount by which the sample variance and covariance differ from their estimates obtained under the assumption that your model is correct. It is, in fact, a badness of fit index and, if computed from standardized variables, a value of RMR should not be more than 0.1 [37] where the smaller the RMR the better. An RMR of zero indicates a perfect fit. Therefore, the refined nine-indicator variable model is more valid model for consideration than the original 11-indicator variable model.

For the purpose of computing GFI in the case of maximum likelihood estimation, ... is calculated as

... with ... is the maximum likelihood estimate of Y.GFI is less than or equal to 1. A value of 1 indicates a perfect fit.

The comparative fit index (CFI) [17] is given by.

...

where C,d, and NCP are the discrepancy, the degrees of freedom and the non-centrality parameter estimate for the model being evaluated, and ... and NCPare the discrepancy, the degrees of freedom and the no centrality parameter estimate for the baseline model. The CFI is identical to the McDonald and Marsh (1990) relative non-centrality index (RNI), except that the CFI is truncated to fall in the range from 0 to 1. CFI values close to 1 indicate a very good fit.

A value of the RMSEA of about .05 or less would indicate a close fit of the model in relation to the degrees of freedom. This figure is based on subjective judgment. It cannot be regarded as infallible or correct, but it is more reasonable than the requirement of exact fit with the RMSEA = 0.0. We are also of the opinion that a value of about 0.08 or less for the RMSEA would indicate a reasonable error of approximation and would not want to employ a model with a RMSEA greater than 0.1.

The RMR (root mean square residual) is the square root of the average squared amount by which the sample variances and co-variances differ from their estimates obtained under the assumption that your model is correct: Following function to compute RMR for each model.

...

The smaller the RMR is, the better. An RMR of zero indicates a perfect fit.

Using the path coefficients in Figure 4, we find support for the theoretical variables that lead to E-commerce Audit Judgment Expertise (ECAJE). The research model was supported significantly for H1 (regression path coefficients = 0.43 p=0.01). This relationship shows that a stronger knowledge/skill level in information and communication technology has a positive relation with ECAJE. The results also provide support for all five corollaries of H1 at highly significant levels, except for H1c (SCME -> ECAJA) that is marginally significant (p = 0.1). In perceptual studies where data on both dependent and independent variables are collected from the same subjects, a problem called common method bias [54] may arise. To investigate whether common method bias was a problem in our data set, we used [54] and [41] method in the PLS model to estimate the common method bias. A common method factor (CMF) was included in the PLS model consisting of the entire set of construct indicators. Each indicator's substantive variances explained by the principal construct and by the CMF were calculated. The results demonstrate that the average substantively explained variance (R21) of the indicators was 0.78 while the average method based variance (R22) was 0.01. The ratio of substantive variance to method variance is approximately 78:1. Even the CMF loadings were very insignificant and of small magnitude. We conclude that the common method bias was not a significant problem in our data set.

The entire path model with ECAJE as the dependent variable explained 59% variance in our model where SCME, ITAE and ICTE are predictors, suggesting a satisfactory outcome for our model in total. Individually, SCME and ITAE as independent variables explained 18% and 43% variance respectively. SCME is a composite of various skills and knowledge sets and the ICTE as a predictor to SCME is one such component. The variance explained by SCME is limited to 18% as it was not within our scope of study to identify other skill sets for SCME and ICTE as outcome and predictor variables. However, ITAE construct's explanation of 43% variance is meaningful considering ICTE as a predictor variable, since IT audit has a significant relationship with ICTE in E-commerce audit expertise.

5 Summary and Conclusions

This study provides a theoretical model and perceptual evidence of the relationship between various IT expertise indicators and expertise in E-commerce audits. We find strong support for our hypothesized relationships, except for a marginal significance for one of the five corollaries.

The findings of this study are supported by the validity of the construct and content. However, we do not make any claim in terms of causality of the relationships. Longitudinal construct measurement might allow for the assessment of the causality of various relationships of the proposed model. In the end, a valid confirmation of the theoretical model should be addressed through model re-estimation on an independent or hold out sample.

The most significant implication of our study to the accounting literature lies in its empirical validation of the E-commerce Audit Judgment Expertise model. The growth of E-commerce technologies in the early 2000's and the need for specific expertise in auditing such entities has created significant need for auditors to expand their knowledge base. Results of this study provide a clear documentation of the directions for expanding auditors' E-commerce audit expertise.

A limitation of the study may be its inability to detect differences between auditors practicing in North-America and other countries. While we find this result to be reassuring in terms of the validity of our overall findings, it may be affected by sample limitations, particularly from auditors practicing in countries located outside North America. Future extensions of the study might be needed to test our findings with larger samples from countries outside North America. This study may be particularly important for certain countries (e.g., China, Japan, the UK) that have significant E-commerce relationships with North-American countries.

Our results have significant implications for education and research. They indicate that auditing courses geared toward educating students in B2B E-commerce audits should include training in information and communication technology, information technology audits, and systems change management. These topics are not typically covered in current auditing text books or introductory audit courses. The same message may be valid for accounting firms seeking to train their auditors for B2B E-commerce audits.

From a research perspective, we see opportunities for model refinement and empirical investigation. First, our generic model focuses on expertise components at a broad level. We have provided only a few indicator variables for each of the latent variables in the model. More detailed indicator variables can be identified and investigated in future research to provide more detailed guidance on the specific indicators of expertise in E-commerce audits.

Finally, as a survey-based perceptual investigation, our study is a snapshot of the proposed model, which means it is in need of further confirmation. For example, future research might use experimental methodology to investigate the effects of various indicator variables on expertise in making specific audit judgments in E-commerce. Such a study might require development of realistic case studies for use in a laboratory setting with measured indicator variables. Qualitative case studies are needed in various E-commerce contexts to assess the validity of this model. Of particular interest in assessing this model would be the audit expertise needed to function in audit teams. With the shared responsibilities of team based audits the required skills sets for each audit may be different from those recommended in this paper.

Acknowledgements

We are thankful to Ron Weber (Monash), Arnie Wright (Boston), Raj Srivastava (Kansas), Steve Sutton (Central Florida), Stewart Leach (Melbourne), Karim Jamal (Alberta), Vairam Arunachalam (Missouri), Rammaya Krishnan (Carnegie Mellon), Larry Gordon (Maryland), Marty Loeb (Maryland), Dan Dhaliwal (Arizona) and Vladimir Zwass (FDU), Roger Debreceny (Hawaii), Jim Hunton (Bentley) for helpful comments on earlier drafts of this paper. The participants at the 2007 AAA annual, 2008 Mid-Year AAA (IS section) and 6th World Congress at Istanbul also contributed to the refinement of this paper. Special thanks to Tom Lamm (ISACA), Barry Melancon, (AICPA), Charles LeGrand, (IIA), Dan Swanson, (IIA), Les Smith (ICAEW), Benjamin Lau (ICAA), David Smith, (CICA), and Ron Salole (CICA) for extending support in various capacities. We also thank senior partners & directors Sri Ramamoorti (Grant Thornton, USA), Toni Panicea (PWC, Canada), Pat Goggins (KPMG Canada), and Jim Pryce (Deloitte Canada) for extensive support of the study. Finally, the first author gratefully acknowledges financial support from University of Windsor under its USSHRC and "RTIF" research grants.

References

References

[1] M. J. Abdolmohammadi, D. G. Searfoss and J. Shanteau, "An investigation of the attributes of top industry audit specialists," Behavioral Research in Accounting, No. 16, 2004, pp. 1-17.

[2] M. J. Abdolmohammadi and A. Sharbatouglie, Continuous Auditing: An Operational Model for Internal Auditors, Altamonte Springs, FL: the Institute of Internal Auditors, 2005.

[3] J. Armstrong and T. Overton, "Estimating non-response bias in mail surveys," Journal of Marketing Research, Vol. 14, No. 3, 1977, pp. 396-402.

[4] A. Abrahami, "Sarbanes-Oxley Act (SOA)," Compliance, Legal Issues, Autumn 2005, pp. 28-31.

[5] R. Agarwal and E. Karahanna, "Time flies when you're having fun: cognitive absorption and beliefs about information technology usage," MIS Quarterly, No. 24, 2000, pp. 665-694.

[6] J. C. Anderson, "An approach for confirmatory measurement and structural equation modeling of organizational properties," Management Science, Vol. 33, No. 4, 1987, pp. 525-41.

[7] J. L. Arbuckle, AMOS 6.0 User's Guide, 2005, pg. 535.

[8] A. H. Ashton, "Experience and error frequency knowledge as potential determinants of audit expertise," The Accounting Review, April 1991, pp. 218-239.

[9] S. Ba and P.A. Pavloe, "Evidence of the effect of trust in electronic markets: price premiums and buyer behavior," MIS Quarterly, Vol. 23, No. 4, 2002, pp. 243-268.

[10] R. P. Bagozzi and Y. Yi, "On the evaluation of structural equation models," Journal of the Academy of Marketing Science, Vol. 16, No. 1, 1981, pp. 74-94.

[11] N. A. Bagranoff and V.P. Vendrzyk, "The changing role of IS audit among the big five US-based accounting firms," Information Systems and Control Journal, No. 5, 2000, pp. 33-37.

[12] B. Ballou, C. E. Earley and J. S. Rich, "The impact of strategic-positioning information on auditor judgments about business-process performance," Auditing: A Journal of Practice & Theory, Vol. 23, No. 2, 2004, pp. 71-88.

[13] E. M. Bamber, "Expert judgment in the audit team: A source reliability approach.," Journal of Accounting Research, Vol. 21, No. 2, 1983, pp. 396-412.

[14] J. Bedard, "Expertise in auditing: Myth or reality," Accounting, Organization and Society, No. 14, January 1989, pp. 113-131.

[15] J. Bedard and M. T. H Chi, "Expertise in auditing," A Journal of Practice & Theory, No. 12, 1993, pp. 21 - 45.

[16] P. M. Bentler and D.G. Bonnett, "Significance tests and goodness of fit in the analysis of covariance structures," Psychological Bulletin, No. 88, 1980, pp. 588-606.

[17] P. M. Bentler, "Comparative fit indexes in structural models," Psychological Bulletin, No. 107, 1990, pp. 238-246.

[18] P. J. Best, G. Mohay and A. Anderson, "Machine-independent audit trail analysis - A tool for continuous audit assurance," Intelligent Systems in Accounting, Finance, and Management, Intelligent Systems in Accounting Financial Management, No. 12, 2004, pp. 85-102.

[19] S. E. Bonner and B. Lewis, "Determinants of auditor expertise," Journal of Accounting Research (Supplement), 1990, pp. 1-20.

[20] S. E. Bonner, "Experience effect in auditing: The role of task specific knowledge," The Accounting Review, No. 55, January 1990, pp. 72-92.

[21] J. F. Brazel, "A measure of perceived auditor ERP systems expertise: Development, assessment, and uses," Managerial Auditing Journal, Vol. 20, No. 6, 2005, pp. 619-631.

[22] J. F. Brazel, C. P. Agoglia and R. C. Hatfield, "Electronic versus face-to-face review: The effects of alternative forms of review on auditors' performance," The Accounting Review, Vol. 79, No. 4, 2002, pp. 949-966.

[23] B. Byrne, Structural equation modeling with AMOS: Basic concepts, applications & programming, NJ: Lawrence Erlbaum Associates, 2001, pg. 291.

[24] CICA, Audit implications of EDI, CICA Toronto, 1996.

[25] CICA, EDI for managers and auditors, 2nd Edition, CICA Toronto, 1993.

[26] CICA, EDP auditing guidelines-EDP 6. EDP Environments-Database Systems, CICA Virtual Professional Library, 2002.

[27] L. DeYoung, "Hypertext challenges in the auditing domain," ACM-Hypertext Proceedings, Pittsburgh, Pennsylvania, United States, ACM-089791-339-6/89/0011/0180. Nov. 1989, pp. 169-180.

[28] P. Frantz, "Does an auditor's skill matter? Responses to and preferences amongst auditing standards," International Journal of Auditing, No. 3, 2002, pp. 59-80.

[29] A. Ghosh, "Addressing new security and privacy challenges," IEEE IT PRO May-June 2002, pp. 10-11.

[30] R. Half, The Next Generation Accountant. Menlo Park, CA: Robert Half International, 2001.

[31] J. V. Hansen and N. C. Hill, "Control and audit of electronic data interchange," MIS Quarterly, December 1989, pp. 403-413.

[32] H. Hsiung, S. Scheurich and F. Ferrante, "Bridging E-Business and added trust: Keys to E-Business growth," IEEE IT PRO, March/April 2001, pp. 41-45.

[33] J. E. Hunton, "Blending information and communication technology with accounting research," Accounting Horizons, No. 1, March 2002, pp. 55-67.

[34] J. E. Hunton, A. M. Wright and S. Wright, "Are financial auditors overconfident in their ability to assess risks associated with enterprise resource planning systems?" Journal of Information Systems, Vol. 18, No. 2, 2005, pp. 7-28.

[35] K. Jamal, M. Maier and S. Sunder, "Privacy in e-commerce: Development of reporting standards, disclosure, and assurance services in an unregulated market," Journal of Accounting Research, Vol. 41, No. 2, 2003, pp. 285-309.

[36] K. G. Joreskog, "Testing structural equation models," in Testing Structural Equation Models, eds. K. A. Bollen and L. S. Long, Sage Publications: Newbury Park, CA, 1993.

[37] R. Kline, Principles & Practice of Structural Equation Modeling, NY: Guilford Press, 2nd edition, 2005.

[38] A. Kogan, E. Sudit and M. Vasarhelyi, "Continuous online auditing: A program of research," Journal of Information Systems, Vol. 13, No. 2, 1999, pp. 87-103.

[39] J. L. Kolodner, "Towards an understanding of the role of experience in the evolution from novice to expert," In Developments in Expert Systems, ed. M. J. Coombs, London, England: Academic Press, 1984, pp. 95-116.

[40] B. Lamberton, J. Fedorowicz and S. J. Roohani, "Tolerance for ambiguity and IT competency among accountants," Journal of Information Systems, Vol. 19, No. 1, 2005, pp. 75-95.

[41] H. Liang, N. Saraf, Q. Hu and Y. Xue, "Assimilation of enterprise systems: The effect of institutional pressures and the mediating role of top management," MIS Quarterly, Vol. 31, No. 1, 2007, pp. 59-89.

[42] R. Libby and J. Luft, "Determinants of judgment performance in accounting settings: Ability, knowledge, motivation, and environment," Accounting, Organizations, and Society, Vol. 18, No. 5, 1993, pp. 425-450.

[43] R. Libby, J. T. Artman and J. J. Willingham, "Process susceptibility, control risk and audit planning," The Accounting Review, No. 2, 1985, pp. 212-229.

[44] T. McCollum, "Stepping into continuous audit," Internal Audit, April 2004, pp. 27-29.

[45] M. McConnell, "Information assurance in the twenty-first century," IEEE Computer, Vol. 35, No. 4, Part-Supplement, April 2002, pp. 16-19.

[46] R. P. McDonald and H. W. Marsh, "Choosing a multivariate model: Non centrality & goodness of fit," Psychological Bulletin, No. 107, 1990, pp. 247-255.

[47] G. McGraw, "Managing software security risks," IEEE Computer, April 2002, pp. 99-101.

[48] G. Merchant, "Discussion of determinants of auditor expertise," Journal of Accounting Research (Supplement), 1990, pp. 20-28.

[49] W. F. Messier, A. Eilifsen and L.A. Austen, "Auditor detected misstatements and the effect of information technology," International Journal of Auditing, No. 8, 2004, pp. 223-235.

[50] G. C. Moore and I. Benbasat, "Development of an instrument to measure the perceptions of adopting an Information Technology innovation," Information Systems Research, Vol. 2, No. 3, 1991, pp. 192-222.

[51] M. Nelson, S. Bonner and L. Robert, "Audit category kinowledge as a precondition to learning from experience," Accounting, Organizations and Society, Vol. 22, No. 5, 1997, pp. 387-410.

[52] J. D. Nunnally, Psychometric Theory. New York: McGraw-Hill, 1978.

[53] M. A. Patton and J. Audun, "Technologies for trust in electronic commerce," Electronic Commerce Research, Vol. 4, No. 1/2, 2004, pg. 9.

[54] P. Podsakoff, S. Mackenzie, J. Lee and N. Podsakoff, "Common method biases in behavioral research: A critical review of the literature and recommended remedies," Journal of Applied Psychology, Vol. 88, No. 5, 2003, pp. 879-903.

[55] B. Raghunathan and T. S. Raghunathan, "Adaptation of a planning system success model to information systems planning," Information Systems Research, Vol. 5, No. 3, 1994, pp. 326-340.

[56] K. Reimers, M. Li and G. Chen, "A multi level approach for devising effective B2B e-commerce development strategies with an application to the case of China," Electronic Commerce Research, Vol. 4, No. 3, 2004, pp. 287-305.

[57] M. J. Rovine, "Latent variable models and missing data analysis," in Latent Variable Analysis: Applications for Developmental Research, eds. A Von Eye and C.C. Cloggs, Thousand Oaks, CA: Sage, 1994, pp. 181-225.

[58] F. Schmidt, J. Hunter and A. Outerbridge, "Impact of job experience and ability on job knowledge, work sample performance and supervisory ratings of job performance," Journal of Applied Psychology, No. 71, August 1986, pp. 432-39.

[59] A. H. Segars and V. Grover, "Strategic information systems planning success: An investigation of the construct and its measurement," MIS Quarterly, Vol. 22, No. 2, June 1998, pp. 139-163.

[60] J. Shanteau, "Competence in experts: The role of task characteristics," Organizational Behavior and Human Decision Processes, No. 53, 1992, pp. 252-266.

[61] J. Shanteau, "Psychological characteristics of expert decision makers," In Expert Judgment and Expert Systems, ed., J. L. Mumpower, O. Renn, L. D. Phillips, and V. R. R. Uppuluri, Berlin: Springer-Verlag, 1987.

[62] R. P. Srivastava and T. J. Mock, "Evidential reasoning for WebTrust assurance services," Journal of Management Information Systems, Vol. 10, No. 3, Winter 2000, pp. 11-32.

[63] M. Subramaniam and M. A. Youndt, "The influence of intellectual capital on types of innovative capabilities," Academy of Management Journal, Vol. 49, No. 3, 2005, pp. 450-463.

[64] J. R. Taylor, J. H. Allen, G. L. Hyatt and G. H. Kim, "Institute of Internal Auditors Global Technology Audit Guides v3.1 Change and Patch G Management Controls: Critical for Organizational Success," IIA Change Management TAG I V 3.1 03/11/05, 2005.

[65] L. Volonino, "Electronic evidence and computer forensics," Communications of the Association for Information Systems, No. 12, 2003, pp. 457-468.

[66] A. C. Weaver, R. J. Vetter, A. B.Whinston and K. Swigger, "The future of E-Commerce," Computer, 2000, pp. 30-31.

[67] D. Welch, D. Ragsdale and W. Schepens, "Training for information assurance," IEEE Computer, April 2002, pp. 30-37.

[68] K. Yuan and P. Bentler, "Mean and covariance structure analysis with missing data," UCLA Statistical Series, No. 193, 1995.