The Economics of Assurance: A Systems-Based Framework for Evaluating Internal Control Effectiveness ()
1. Introduction
Under conditions of unprecedented economic volatility and the complication of the regulatory environment, which is accompanied by accelerating digital transformation, the role of internal control mechanisms in corporate governance has changed substantially. Ensuring the effectiveness of the internal control system has ceased to be a narrow function oriented exclusively toward compliance with regulatory requirements; it has transformed into a defining factor of competitive advantage and the provision of the long-term resilience of organizations. Management and stakeholders demand not a simple confirmation of the presence of controls, but confidence that these systems are capable of protecting, creating, and realizing value for the business.
Traditional approaches to the evaluation of internal control, which are often based on the Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework, have historically focused on binarity—“effective” or “material weaknesses exist”. However, such an approach does not allow top management to regard control as a strategic investment. In order for it to become a full-fledged element of management, a mechanism is required that will link resources with measurable economic returns.
Modern internal audit is undergoing significant transformation. It is expected that the relevant specialists will not only provide objective assurance regarding the effectiveness of governance, risk, and control, but will also actively add value by offering advisory input to improve operations and by contributing to the achievement of strategic goals. Whereas earlier the focus was on minimizing losses, now the emphasis is shifting to maximizing productivity and effectiveness.
In response to these demands, turning to the problematics of a system-oriented model of effectiveness evaluation becomes timely. This holistic framework is based on an interdisciplinary approach, integrating fundamental economic theories, modern principles of risk management, and digital metrics. Effective internal control should be perceived not as a burdensome cost center but as an investment that ensures measurable economic returns.
From the standpoint of economics, the value of internal control is not limited to preventing direct losses—it includes increasing an organization’s flexibility and strategic responsiveness. The model described in the article is aimed at evaluating the ability of the internal control system to observe and sustain dynamic, rapidly changing environments, which is critically important for companies undergoing large-scale transformations (for example, the implementation of new Enterprise Resource Planning (ERP) systems or post-merger integrations).
2. Research Methods
The content of this article represents a synthesis of theoretical modeling and economic analysis. The methodological base of the work is built on a multilevel approach intended to ensure the validity and practical applicability of the model.
First, a method of systematic theoretical review was applied in order to integrate key concepts from economic theory and corporate governance. Central place here is occupied by the analysis of agency theory and transaction cost economics, which form the basis for understanding the need for effective internal control.
On the basis of this “foundation,” a deductive systems framework of the system-oriented approach was described, in which the conceptual components (COSO, the Three Lines model) are logically linked with measurable financial results. A key element of the methodology is quantification—to translate qualitative assessments of control effectiveness into economic indicators. In particular, for evaluating the incremental effectiveness of control procedures and the probability of system failure, reliability theory was adapted. Besides this, for the purpose of ensuring proportionality of the costs of control to expected benefits, attention is given to cost-benefit analysis, which is a key tool of financial decision-making.
Reliability Theory, in the context of internal control, is a quantitative approach used to estimate the probability that a process or system will fail over a given period. It treats control components like interconnected system elements, allowing organizations to model failure rates, identify weak points, and forecast how changes in controls improve overall process reliability.
To evaluate the incremental effectiveness of control procedures and to translate the probability of failures into monetary risk, reliability theory adapted from the field of IT audit and systems design is used.
As an integral indicator of economic return, the metric Assurance ROI (Return on Investment) is chosen. Although such alternatives as EVA (Economic Value Added) or NPV (Net Present Value) are more sophisticated for evaluating capital investments, since they include the cost of capital, they have limited applicability for evaluating the effectiveness of the internal control or audit function, whose value is distributed and not always directly connected with WACC (Weighted Average Cost of Capital). ROI, by contrast, is a universal instrument most understandable to managers; it clearly compares net benefit (Avoided Costs + Efficiency Benefits) with the program costs for maintaining and improving control, which is optimal for justifying managerial investments.
3. Results and Discussion
To build a reliable framework for evaluating the effectiveness of internal control, it is necessary to turn to basic economic concepts through which the mechanisms of corporate value creation and destruction are explained.
Thus, agency theory serves as a fundamental link in understanding the need for control. Within it, the inevitable conflict of interests arising between principals (owners, shareholders) and agents (managers who carry out operational management) is considered. Adam Smith already noted that under such conditions negligence and waste will always prevail in the management of a company’s affairs to a greater or lesser extent (Jensen & Meckling, 1976).
The internal control system acts as a critically important monitoring mechanism aimed at reducing these agency costs. These include, first, monitoring costs (expenses for audit and oversight) and, second, bonding costs (expenses associated with establishing restrictive contracts or incentives). An effective internal control system substantially reduces the probability of opportunistic behavior by management—manipulation of financial reporting or making decisions beneficial personally to the manager and not to shareholders. In addition, studies show that effective control contributes to the reduction of “double agency costs” associated with conflicts between majority and minority shareholders. The reduction of these conflicts, in turn, correlates with the improvement of corporate social responsibility (Yang, 2019; Al-Faryan, 2024). “Double agency costs” refer to the incremental economic losses that arise when majority and minority shareholders pursue different objectives, creating an additional layer of monitoring, negotiation, and protection costs on top of standard principal–agent frictions. Unlike the classic principal–agent problem—which focuses on conflicts between owners and managers—double agency costs capture conflicts within the ownership group itself, driven by unequal control rights and information asymmetry among shareholders.
As for Oliver Williamson’s transaction cost economics, here the firm is considered as a hierarchical structure intended to manage exchange relations more effectively than market mechanisms. In this model, internal control acts as a key element of the governance structure necessary to ensure the effectiveness of transactions.
For a large international corporation managing complex global supply chains, control is critical for solving make-or-buy dilemmas and preventing opportunism in relations with suppliers and customers. When transactions are complex and accompanied by assets specific to the given deal, effective internal control is required to standardize processes and ensure their reliability.
Deficiencies of internal control have tangible macroeconomic consequences affecting the valuation of the company and its investment decisions. Research convincingly demonstrates that significant flaws in it lead to an increase in the cost of capital for the firm. The market, perceiving weak control as a sign of increased risk (risk premium), inevitably reduces the valuation of the economic entity (Jacoby et al., 2017).
It is advisable to note that a decline in stock value often occurs before the enterprise officially discloses information about deficiencies of the internal control system. This may indicate that the market reacts both to formal compliance reports and to general signs of weak corporate governance—declining operating effectiveness or leakage of sensitive information. This underlines the fundamental preventive (and not reactive) value of the control actions in question (Jacoby et al., 2017).
In addition to the above, inefficiency is associated with a reduction in the quality of investment decisions, which manifests itself in suboptimal allocation of resources, including over- or under-investment in labor. High-quality control is also quite significant for mitigating risks associated with major strategic decisions—mergers and acquisitions—and increases the effectiveness of working capital management (Cao, Chen, Jiang, & Xiang, 2022; Chen, Wang, Yang, & Zhou, 2025).
Thus, the characterized system serves as a key factor ensuring managerial discipline and the rationality of investment decisions. For clarity, the main economic consequences of ineffective control are presented in Table 1.
Table 1. Systematization of the economic consequences of ineffective internal control (compiled by the author).
Economic
Indicator |
Impact of Deficiencies |
Economic Implication for the System-Oriented Model of Effectiveness Evaluation |
Cost of capital |
Significant increase
(through risk premium) |
Control directly affects the cost of financing (WACC) |
Firm valuation |
Decrease (market reaction occurs before ICW—Internal Control Weakness—disclosure) |
The value of internal control lies in its preventive, not reactive, function |
Effectiveness of labor investments |
Decrease (leads to
over-investment and
under-investment) |
ICW reduces the effectiveness of allocating key resources |
Working capital management |
Decrease in accounts receivable turnover, growth of delinquency |
Low control effectiveness affects the increase in working capital needs |
The architectural “core” of the system-oriented model of effectiveness evaluation is based on the widely recognized framework of the Committee of Sponsoring Organizations of the Treadway Commission (COSO), which serves as the basis for design, implementation, and evaluation; it orients the control system toward achieving organizational objectives in three key categories:
Operational effectiveness;
Reliability of reporting;
Compliance with legislation (compliance) (Wolters Kluwer, 2024).
In the model under consideration—relying on COSO as the “foundation”—it is emphasized that the effectiveness of the system analyzed is determined both by the presence of individual control procedures and by the quality of the entire control environment. Of particular importance is the monitoring component, which, according to COSO, should be continuous, giving management the opportunity to promptly adjust the system. It is precisely this principled approach, including the evaluation of the 17 COSO principles, that ensures an organization’s ability to adapt to changes (Wolters Kluwer, 2024).
The complication of the risk environment required the modernization of the traditional Three Lines of Defense model. It is used as a structural basis for the distribution of responsibility and for providing audit assurance (The Institute of Internal Auditors, 2025).
Thus, the first line owns and manages risks, and is also responsible for the design and functioning of controls. The second provides oversight, frameworks, and methodologies for identifying emerging risks. Internal audit represents an independent, objective third line providing assurance on all matters of governance, risk, and control.
A key requirement is the need for coordination among all assurance providers (internal and external), which makes it possible to reduce duplication of effort and identify gaps in covering key risks. If internal audit is perceived as a less valuable source of assurance compared to the second line, this is a strategic risk for the audit function itself. Consequently, the model considered in the article is aimed at proving the strategic value of internal audit, shifting the emphasis from assessing simple compliance to evaluating the effectiveness of control in the context of achieving business objectives.
For internal control to have real economic impact, it should be integrated with strategic management. The updated COSO Enterprise Risk Management (ERM) 2017 framework emphasizes the importance of integrating risk with strategy and performance, since this helps the organization create, preserve, and also realize value.
In the context of the described system-oriented model, this means that internal control cannot function in isolation. Effective risk management should be part of the organization’s strategic responsiveness. The inclusion of strategic risk management evaluation in corporate governance makes ERM more effective in terms of achieving financial goals.
Thus, the model characterized in the article represents a synthesis that allows the third line to use the results of monitoring conducted by the first and second lines to provide management and the board of directors with strategically significant information. It should concern how the current functioning of controls either contributes to the implementation of strategy or hinders it. The transition from focusing on “Control” to concentrating on “Assurance” is required so that internal audit can prove its economic value by linking control metrics (KCI) directly to economic results (ROI).
Quantification of effectiveness serves as the central element of the model under consideration, which helps translate theoretical value into measurable financial indicators. Thus, for the purpose of creating a measurable link between control and economic results, a unified system of metrics covering all three lines is required. At the base of this system lie the following key indicators:
KPI (Key Performance Indicator)—indicators reflecting overall business effectiveness (for example, accounts receivable turnover, total factor productivity);
KRI—indicators applied for monitoring and tracking the level of risk. They serve as proactive signals;
KCI—indicators intended for tracking the effectiveness of control procedures in achieving their specific objectives. It is extremely important that KCIs be directly linked to the corresponding KRIs and ultimately influence KPIs (Parkkinen, 2023; Metricstream, 2025).
A quantitative linkage can be built by defining how a change in a KCI (e.g., improved control adherence) statistically reduces the likelihood or impact of a risk event, thereby shifting the corresponding KRI. That adjusted KRI value can then be mapped to its expected effect on a KPI (e.g., costs, cycle time, or error rates), allowing measurable improvements in control performance to translate into forecasted business outcomes.
In the system-oriented model under consideration, these metrics are integrated into the concept of risk intelligence, which makes it possible to transform disparate KCI and KRI data into predictive signals that ensure the making of well-grounded managerial decisions aimed at cost reduction and increasing effectiveness. If a KCI demonstrates a decline in control effectiveness (for example, a rise in the percentage of erroneous transactions), this immediately leads to a revision of KRIs and a forecast of negative impact on key business indicators (Ethico, 2025).
For the precise evaluation of economic returns from specific control measures, the model provides for methodologies that ensure the evaluation of incremental effectiveness—the economic gain obtained from the implementation or improvement of the given control.
One powerful instrument is reliability theory. This mathematical concept can be practically applied to evaluating the probability of system failure (especially in the sphere of data processing) and the subsequent comparison of this probability with the cost of controls required to minimize vulnerability (Barrett et al., 1977). The use of the theory described allows internal auditors to provide management with precise calculations of expected savings obtained through reducing the risk of failures.
In addition, the model requires the implementation of rigorous cost-benefit analysis. In the context of internal control, costs include expenses for implementing and maintaining controls, and benefits include both prevented financial losses and the reduction of compliance costs and direct savings of operating costs. In the end, proportionality of the control burden to expected benefits is ensured (Harvard Business School: HBS Online. Business Insights, 2025).
To systematically demonstrate economic value, the Assurance ROI metric is introduced. It adapts the framework for calculating the return on investments in risk intelligence to the specifics of the control and audit function. The calculation of the return on assurance is performed by the formula:
where:
Cost Avoidance—includes avoidance of regulatory fines, prevention of losses from incidents (for example, cyberattacks or fraud), mitigation of legal risks;
Efficiency Gains—savings from process automation, improvement of data accuracy, increased coordination among the lines of defense, acceleration of problem resolution timeframes;
Program costs—these are direct expenses for maintaining the internal control system, including technology, personnel, and training (Agile ROI, 2025; FCA, 2024).
A summary description of the model is given in Table 2.
Table 2. System model for the quantification of internal control effects (compiled by the author).
Metric Level |
Measurement Objective |
Indicator examples |
Link with Economic Value |
KPI
(Performance) |
Business effectiveness (1st line) |
Accounts receivable turnover, TFP (Total Factor Productivity), cost of capital |
The overall value that internal control seeks to protect/improve |
KRI (Risk) |
Risk forecasting
(2nd line) |
Level of overdue
AR > N days; percentage of IT system failures |
Early warning of potential losses |
KCI (Control) |
Control effectiveness (1st and 2nd lines) |
Percentage of erroneous invoices; frequency of security patch updates |
Direct assessment of the effectiveness of investments in control mechanisms |
ROI (Assurance) |
Economic return
(3rd line) |
Prevented losses; savings from automation, improvement of TFP |
Demonstration of the added value of the audit function |
It is advisable to combine key quantitative findings and present an authoritative statistical context obtained from professional sources (Table 3).
Table 3. Summary of quantitative evidence on internal control effectiveness (2020-2025). (PCAOB, 2025; Chen & Fan, 2024; NYU Stern, 2025; Bai, Zhang, & Yang, 2025)
Area of Impact |
Metric |
Direction of effect of strong internal control |
Observed quantitative impact (synthesis 2020-2025) |
Key mechanism/context |
Cost of capital |
WACC |
Decrease |
Reduction in the cost of equity premium by 50 - 150 basis points, persisting after eliminating deficiencies |
Reduction of information asymmetry and operating/legal risks |
Firm
valuation |
Рыночная (Tobin’s Q/M/B) |
Increase |
Average valuation premium of 5% - 12% for firms with
sustained effective internal control (clean opinions) |
Increased investor confidence; signal of management quality |
Operational effectiveness |
TFP |
Increase |
Increase in effectiveness/protection of TFP, leading to a potential improvement of 2% - 5% due to eliminating capital distraction and operational friction |
Optimized capital allocation; improved working capital management (e.g., reduction of DSO—Days Sales Outstanding) |
Non-financial governance |
ESG (Environmental,
Social, and Governance)
ratings/cost of debt |
Improvement/decrease |
Strong internal control
correlates with higher ESG ratings and provides access to preferential financing
(e.g., green loans), which reduces the cost of debt |
Data integrity, control over non-financial inputs, audit readiness |
The data show that strategies for investing in control should rely on an integrated value model. The cost of a control failure is no longer limited to the financial sphere (growth of WACC) but is multiplied by its influence on operational effectiveness (reduction of TFP) and reputation (ESG rating discount).
To demonstrate the principles of quantification, consider a conditional example related to the optimization of a critical operating process—procure-to-pay (P2P). Conditionally—in a large manufacturing company using a manual process of invoice processing—there are high risks of duplicate payments to suppliers and fraud. Significant transaction costs are also observed, since manual processing often leads to errors requiring costly and labor-intensive corrections, the cost of which, according to industry estimates, can reach 53 US dollars per error. It is necessary to describe the linkage of metrics (before implementing the control):
KPI (operational effectiveness)—low, measured through the high cost of the P2P cycle;
KRI (risk indicators)—the number of suspicious transactions exceeding the limit (for example, >2% of the total), which indicates a high risk of fraud;
KCI (control indicators)—a low percentage of automatic matching of PO/GR/ Invoice (Purchase Order; Goods Receipt), which demonstrates insufficient effectiveness of control.
Action within the model—the implementation of an automated continuous monitoring system that uses analytics to identify duplicate payments and unauthorized changes to vendor master data.
Regarding the evaluation of the effect, it should be noted that the improvement of KCI (an increase in the percentage of automatic matching to 95%) leads to a decrease in KRI (the number of suspicious transactions decreases). This is transformed into a measurable economic effect.
For the systematic calculation of Assurance ROI, a five-stage quantification algorithm is used, which ensures the transparency of translating non-financial metrics into monetary indicators (Table 4).
Table 4. Algorithm for quantifying the control effect (compiled by the author).
Stage |
Task |
Metrics and
tools used |
Description |
1. Selection of metrics |
Establish a measurable link between control and strategy |
KPI, KRI, KCI |
Determine which key business indicator (KPI) is at risk. Select the corresponding KRIs (warning signals) and KCIs (assessment of control effectiveness). |
2. Collection of baseline data |
Assess risk and costs before implementing/improving control |
Data on error frequency, losses,
labor costs |
Fix the initial level: annual frequency of fraudulent losses, average cost of correcting an error ($50 per error), total expenses for maintaining manual controls |
3. Attribution of effect |
Clearly determine which part of the improvement is associated with the control |
Reliability theory, sensitivity analysis |
Using reliability theory, estimate to what extent the new control reduced the probability of system failure. Mathematically attribute the change in the KPI (for example, the reduction of losses) directly to the control action |
4. Monetization |
Translation of the effect into monetary indicators |
Assurance ROI (formula) |
Multiply prevented incidents (Cost Avoidance) and reduced labor costs (Efficiency Gains) by their monetary equivalent |
5. Sensitivity analysis |
Evaluation of the reliability of the obtained ROI when changing input data |
Scenario modeling (NPV — Net Present Value; IRR — Internal Rate of Return; ROI) |
Test how the final Assurance ROI will change if the actual program costs or the benefits obtained differ from the projected values, ensuring managerial flexibility |
For visual confirmation of the thesis about the strategic investment value of control, we present a hypothetical ROI calculation for the continuous monitoring system program described above in the P2P process (Table 5).
Table 5. Hypothetical assurance ROI calculation for the P2P process (compiled by the author).
Indicator |
Baseline data |
Calculated results (USD) |
ROI category |
Control program (costs) |
IT system/software |
- |
150,000 |
Program Costs |
Personnel (Internal Audit/Risk) and training |
250,000 |
Program Costs |
Total program costs |
400,000 |
D |
Economic return (benefits) |
Prevented fraud losses |
Reduction by 90% of projected losses
($250 k) → 225,000 |
225,000 |
Cost Avoidance |
Reduction of regulatory fines |
Avoidance of a fine for 1 incident per year |
500,000 |
Cost Avoidance |
Savings on manual transaction review |
eduction of 1 FTE (Full-Time Equivalent) in the Accounts Payable department |
75,000 |
Efficiency Gains |
Total economic return |
- |
800,000 |
N |
Assurance ROI |
(N − D)/D * 100 |
(800,000 - 400,000)/400,000 * 100 |
200% |
A result of 200% Assurance ROI demonstrates that every dollar invested in the control program brings 2 dollars of net economic benefit, which is a key argument for management when making decisions on further digitalization of the internal control system.
Organizations may struggle to gather accurate baseline risk and cost data due to fragmented records, manual processes, and limited measurement systems, especially in less-automated environments. A pragmatic approach is to combine sampled empirical data with expert judgment and conservative estimation ranges, updating assumptions iteratively as better information becomes available.
Digital transformation exerts a deep influence on internal control, acting as a powerful “driver” of its effectiveness. The main mechanism of its influence manifests itself in the possibility of embedding control procedures directly into business processes. Owing to this, authorization and balance checking in real time are ensured, the human factor is minimized, and the possibility of circumventing controls is prevented.
Research shows that the increase in the effectiveness of internal control achieved through digitalization leads to growth in the organization’s total factor productivity. This confirms that the economic benefit from digital tools goes beyond simple risk reduction. Besides this, an optimized and automated system (Digitalized ICS—Internal Control System) helps reduce the administrative burden placed on finance and operations departments. Resources thus freed can be directed to more strategic “business partnering” and analytical activity. As a result, internal control is transformed from a passive function into an active element of value creation (Li et al., 2024; Oschlisniok & Szymanski, 2025).
In the era of digitalization, traditional one-time assessments of control become insufficient. Continuous audit and monitoring replace outdated methods, providing data on risks and controls in real time. Automation, especially in the area of IT controls, increases both effectiveness and economic performance, reducing labor costs.
For successful implementation and effective risk intelligence, close integration of information systems and deep expertise in IT audit are required. It is advisable both to develop metrics and to use existing IT tools for the systematic collection and analysis of data. Continuous monitoring thus becomes a key component of the model characterized, helping management make risk-based decisions and promptly adjust strategies.
The integration of artificial intelligence and machine learning into business processes significantly increases accuracy, reduces errors, and automates routine audit tasks. This allows efforts to be redirected to strategic consulting and the management of emerging risks. Meanwhile, such a deep transformation gives rise to new, more complex challenges for internal control (Arham, 2025).
One of the most acute issues is the problem of transparency or the “black box” of algorithms. If the auditor cannot explain how an AI system arrived at a specific conclusion, this calls into question due professional care and the integrity of results. A second critical risk is associated with algorithmic bias, which arises due to the use of incomplete, poor-quality, or insufficiently diverse data. This can undermine the objectivity of the system and lead to discriminatory or erroneous business decisions (Kamareldawla, 2025).
Distributed ledger technology, in particular blockchain, has enormous potential for increasing the security and reliability of financial reporting and audit. Owing to its characteristics—immutability of data, transparency of transactions—it helps reduce the risks of falsification, ensuring a reliable audit trail (Mohammed Abdul, 2024).
However, wide-scale implementation of the technology in question is associated with serious challenges that must be taken into account in the model characterized in the article. First, there are problems of technological integration and insufficient scalability of public networks (for example, low throughput, significant transaction latency), which complicates their application in global corporate environments. Second, critically significant is the lack of standardization and regulatory certainty. For internal audit, this means the need to develop flexible control procedures capable of evaluating the integrity of data and the compliance of DLT (Distributed Ledger Technology) systems under conditions of changing legislation and the absence of unified industry protocols.
4. Assumptions, Limitations
As for the assumptions, it should be noted that the framework is created for application in an environment of large, highly digitalized corporations, where:
A developed risk management system (COSO ERM) and control (COSO ICIF—Internal Control-Integrated Framework) is applied;
There is a high level of process automation, which makes it possible to obtain granular data for the calculation of KCI (Key Control Indicator) in a regime of continuous monitoring;
There is significant financial vulnerability to regulatory fines and failure losses, which makes Cost Avoidance a significant factor.
Despite its applied orientation, the framework has a number of limitations:
The key methodological complexity is the precise isolation of the effect contributed by a specific control improvement from the influence of external macroeconomic factors or managerial decisions not related to control. Future studies could adopt causal inference techniques—such as regression models with control variables to separate the effect of a specific control change from contextual factors, or a difference-in-differences design comparing treated and untreated groups over time—to improve attribution and reduce bias in measuring control effectiveness;
The applicability and significance of individual KCI/KRI (Key Risk Indicator) can vary substantially among industries (for example, between the financial sector and heavy industry), which requires individual tuning of the model;
The calculation of avoided costs always remains prognostic and depends on the correctness of the assessment of potential but unrealized losses (for example, prevented fraud). This requires the mandatory inclusion of sensitivity analysis at the verification stage.
5. Conclusion
With the help of the system-oriented model of effectiveness evaluation considered in the article, a kind of theoretical “bridge” is proposed between economics and internal control. It is demonstrated that the control in question is a critically important link of corporate governance, ensuring measurable economic returns. In the model characterized, fundamental concepts of reducing agency and transaction costs are integrated with modern frameworks (COSO ICIF, COSO ERM, the Three Lines model) and digital quantification tools (Assurance ROI, KCI).
By means of the model, internal control is repositioned from a cost center to a strategic investment. As for practical recommendations for corporate governance subjects:
For management and boards of directors, it is proposed to use the Assurance ROI framework for justifying capital and operating investments in the digitalization of the internal control system. It is advisable to shift the focus from reactive correction of identified deficiencies to proactive risk management, using risk-intelligence data (KCI/KRI). Decision-making should be based on the calculation of avoided costs, and not only on the cost of control procedures;
For internal auditors, the implementation of the system-oriented model requires specialists to master an interdisciplinary approach in which financial, operational, and IT expertise are combined. Auditors should actively participate in the development of their own methods for assessing risks associated with new technologies. It is very important to maintain independence and objectivity, especially under continuous monitoring conditions, and to guarantee compliance with ethical principles regarding algorithmic bias.
As it appears, thanks to the model considered in the article, a solid basis is created for further empirical research. Validation is needed of the relationships between key control indicators (KCI), risk (KRI), and macroeconomic indicators (TFP and cost of capital) in various industry contexts. In addition, subsequent research is relevant in the field of developing standardized metrics for assessing factors associated with the transparency and bias of artificial intelligence systems, as well as the long-term economic consequences of applying continuous audit in environments where DLT technologies are used, considering their current problems of scalability and standardization.