Governance of artificial intelligence applications in a business audit via a fusion fuzzy multiple rule-based decision-making model

Abstract

A broad range of companies around the world has welcomed artificial intelligence (AI) technology in daily practices because it provides decision-makers with comprehensive and intuitive messages about their operations and assists them in formulating appropriate strategies without any hysteresis. This research identifies the essential components of AI applications under an internal audit framework and provides an appropriate direction of strategies, which relate to setting up a priority on alternatives with multiple dimensions/criteria involvement that need to further consider the interconnected and intertwined relationships among them so as to reach a suitable judgment. To obtain this goal and inspired by a model ensemble, we introduce an innovative fuzzy multiple rule-based decision making framework that integrates soft computing, fuzzy set theory, and a multi-attribute decision making algorithm. The results display that the order of priority in improvement—(A) AI application strategy, (B) AI governance, (D) the human factor, and (C) data infrastructure and data quality—is based on the magnitude of their impact. This dynamically enhances the implementation of an AI-driven internal audit framework as well as responds to the strong rise of the big data environment.

Highlights

• Artificial intelligence (AI) promotes the sustainability development of audit tasks.

• A fuzzy MRDM model extracts key factors from large amounts of data.

• Fuzzy decision-making trial and evaluation laboratory analysis accounts for dependence and feedback among factors.

• An effective framework of AI-driven business audit is proposed in which “AI cognition of senior executives” is the most important criterion.

Introduction

Artificial intelligence (AI) includes the ability to reason, learn, and adapt and can be widely used across business operations to automate tasks, decision-making, and customer relationship management (McCollum 2017; Hsu et al. 2022a). The 2019 survey done by Gartner (a leading research and advisory company) indicated that business operation adoption of AI grew 270% in the previous four years. Global spending on AI in 2019 was $37.5 billion and is expected to be $97.9 billion in 2023 (IDC 2019).

Accounting and auditing are clearly influenced by the engulfing nature of AI implementation. The Big Four accounting firms (Deloitte, EY, KPMG, and PwC) have recently launched their own AI systems that are able to track environmental changes, automatically recognize and analyze data, enter invoices, and generate financial reports, thereby improving the efficiency and quality of traditional audit procedures. These AI systems are likely to replace basic accounting clerks and allow managers with a scant accounting background to make appropriate judgments by relying on basic accounting information (Muggleton 2014; IIA 2017d).

Internal auditors are viewed as gatekeepers to ensure the accountability of information and to protect shareholders’ wealth. Lacking any sufficient audit inspection, a routine internal audit procedure has a higher chance of ending up as an audit failure. To combat this, accounting and auditing firms have embraced AI technology with the benefits of increasing auditor efficiency, improving decision consensus, the ability to deal effectively with large amounts of messages, and the ability to communicate relationships. Reports also indicated that accounting and auditing professionals equipped with AI technology can detect problems and potential losses more quickly, and solutions can be reinforced before any damage to the corporate arises (PWC 2018; Alina et al. 2018). The increased prevalence of AI within the accounting and auditing profession is likely to transform current accounting practices. Thus, it is worthwhile to investigate the current development of AI application in the accounting and auditing professions and revise/adjust the traditional auditing procedure to meet the constantly changing business environment (Negnevitsky 2005; Meng et al. 2021).

The McKinsey Global AI survey revealed firms as laggards across sectors that are slow in AI adoption due to barriers and perceived risks of privacy violation, unintentional bias, and other adverse outcomes. The Institute of Internal Auditors (IIA) released its Global Perspectives and Prospects Report (IIA 2017a), which discusses the factors necessary for the AI internal audit profession and hopes that internal auditors have a basic understanding of AI and have sufficient ability for the development of AI for enterprises. This agency proposed a set of AI-based internal audit frameworks, which include the three major aspects of AI strategy, AI governance, and human factors (IIA 2017b, c).

The AI-based internal audit frameworks released by IIA do not consider the relative essence of each factors and ignore the inherent cause-and-effect relationships among them that will result in companies still remaining as laggards in their implementation of an AI adoption strategy. A good AI-driven internal audit framework evaluation model should thus help enterprises translate strategy into action, offer some predictive measures concerning business performance, and answer the following questions. (1) What is the interrelationship among the dimensions/criteria for successful AI-driven internal audit framework adoption? (2) How to prioritize the essence of these dimensions and criteria? (3) How to measure the performance of an AI-driven internal audit framework? (4) What is the actual level of the performance of an AI-driven internal audit in the real workplace and how to make progress over time?

Past studies on AI applications in the internal audit process have mainly used interviewing, observation, and traditional statistical methods to reach their findings (Baldwin et al. 2006; O’Leary and Watkins 1995; Omoteso 2012; Sutton et al. 2016; Alina et al. 2018). Traditional statistical methods assume the dimensions and criteria are independently, linearly, and hierarchically structured (Peng and Tzeng 2019). However, in the real workplace the issues of an AI-driven internal audit framework are often characterized by interdependent relationships among dimensions/criteria and may even show feedback-like effects. Thus, statistical methods seem not suitable to handle the above-mentioned tasks.

Therefore, this study considers the AI application factors of AI applications in the internal audit process and their complex interactive relationships (Liou 2011; Hirsch 2018; Nayak and Misra 2019) and quantifies the data by means of expert surveys. The end goal is to identify the key influence factors and to improve the efficacy and efficiency of internal audit processes in the era of big data. An innovative decision framework called fuzzy multiple rule-based decision making (FMRDM) model, including fuzzy c-means (FCM), the dominance-based rough set approach (DRSA), fuzzy decision making trial and evaluation laboratory (FDEMATEL), and modified-VIKOR (VlseKriterijuska Optimizacija I Komoromisno Resenje) is introduced to assist internal auditors in smoothly adopting AI-driven technology in their daily audit process.

For an unknown domain, users tend to collect as much information as possible to conjecture its real situation. However, too much information will impede/bias their decision making process and increase their cognitive burden (Li et al. 2021; Hsu et al. 2022b; Chang et al. 2022; Kou et al. 2022). To overcome this, filtering out redundant and irrelevant factors turns out to be an important pre-process. Before filtering the model execution of DRSA, the decision variables need to be assigned beforehand. Thus, FCM is taken to group data into a higher concept hierarchy that can be employed as decision variables. By joint utilization of FCM and DRSA, we are able to screen the core factors from a considerable amount of influential factors and thus complete the finalized questionnaire and prevent large storage requirements.

With the merits of applying mathematical techniques to obtain logical and direct impact relationships among factors and performing a directed graph to visualize the complicated causal relationships, decision making trial and evaluation laboratory (DEMATEL) has been widely adopted in many research fields and gained much success (Hu et al. 2021a, b; Meng et al. 2021; Kou et al. 2021a, b). As a company’s operating environment is commonly full of vagueness and uncertainties and users’ preferences are unclear and too complicated to estimate by exact numerical values, the fuzzy concept is suitable for handling such tasks (Zadeh 1975). Hence, there is a requirement to incorporate fuzzy concept into DEMATEL (Jeng and Tzeng 2012; Lin et al. 2018), especially in today’s ill-defined situations like AI applications in the internal audit process.

To demonstrate the effectiveness of the FMRDM framework, we consider 4 publicly-listed companies that have adopted AI as an internal audit technique in China’s manufacturing industry. Based on a survey issued by the National Bureau of Statistics (2019), this industry’s growth rate exceeds the growth rate of the gross domestic product, and its tax payments and hired employees account for 90% of all industries. Because of so many essential characteristics of the manufacturing industry, the study takes it as an example and further exploits undiscovered information so as to yield a suitable direction for future policy development.

This research contributes to the literature on AI-enabled internal audit process as follows. First, it considers comprehensive and overarching factors of AI applications in the internal audit process. The results can be used in ranking and selection, for building AI-driven internal audit improvement strategies, and for solving traditional statistical methods. Second, a joint utilization of FCM and DRSA is executed to exploit domain and hidden messages from stored data via a rule expression format that makes it easier and intuitive for users to connect premises and outcomes arising from the inspection of those premises. Third, the dependency and feedback relationships among dimensions/criteria of AI applications in a fuzzy environment are fully depicted by FDEMATEL (Lin et al. 2018). Realizing the mutual influence among dimensions/criteria in an internal audit process can assist auditors in seeing which dimension/criterion plays an essential role and thus further allocate limited auditing resources more efficiently. Fourth, the modified-VIKOR method lists individual and holistic factors and further assesses and improves the performance gaps for each indicator (criterion) and aspect (dimension) of the sample cases. For the best development strategies, it brings the performance gap improvement closer to zero. The influential network relationship map (INRM) helps to systematically reach a desired level (Hu et al. 2020). Our work reduces uncertainty and gains deeper insights into AI applications for internal auditing. Finally, we offer suggestions for government authorities on how to align the current structure of regulatory filings from our observations with actual application needs.

The remainder of this article is as follows. In "Literature review" section reviews the existing literature on AI applications in an internal audit for companies. In "A hybrid FMRDM model" section proposes our methodologies. In "Research design and result analysis" section analyzes the research design and empirical results. In "Conclusion" section concludes. Figure 1 illustrates the structure of AI applications in a business audit.

Fig. 1

The structure of the AI applications in a business audit

Literature review

The information technology effects brought by AI are both deep and widespread, while internal auditing has become more complicated and cumbersome (Pizzi et al. 2021; IIA 2017d). This study expands the existing perspectives and framework for internal audit research (herein FMRDM, see Fig. 2) and digs deeper into the issues faced by internal auditors under AI. According to the AI internal audit framework proposed by the Institute of Internal Auditors (IIA 2017a, b, c), as well as related literature of AI internal audit and the characteristics of internal audit in China, this study divides AI internal audit factors into four dimensions for evaluation: “AI application strategy”, “AI governance”, “Data infrastructure and data quality”, and “The human factor” (Atmaca and Karadaş 2020; IIA 2017a, b, c; Kou et al 2021a, b; Schmitt 2022). Each dimension is described in detail in this section.

Fig. 2

FMRDM for AI applications in the business audit process

AI application strategy

The AI application strategy of enterprises can be said to be an extension of big data or digital strategies. It can help enterprises obtain more comprehensive and useful information from big data. With this information, enterprises can make better decisions and provide customers with different kinds of services and competencies from competitors (Schotten and Morais 2019; Atmaca and Karadaş 2020). The AI application strategy should be developed in collaboration with executives who can explain the expected outcomes of AI activities and the relationship of these results to enterprise objectives (Jarrahi 2018; Gil et al. 2020). It is necessary for internal auditing to understand the technical capabilities, limitations and expectations of enterprise AI, and to supervise and manage the implementation of AI strategies. In an AI environment, both the capabilities of employees and the gap in their AI knowledge can influence the promotion of AI application strategies (Zhu et al. 2020). Checks and inspections are the due responsibility of internal auditing (McCollum 2017). To maintain a stable operation and development of the enterprise, internal auditing should also determine whether the AI technology supplier has sufficient capabilities to meet the needs of the enterprise and respond to the rapidly changing network environment (Rodríguez et al. 2016; Hu et al. 2021a, b). To make AI be a competitive advantage for enterprises, internal auditing should be involved in assisting the management and board of directors to develop a well-thought-out AI application strategy that meets enterprise objectives (Rodríguez et al. 2016).

AI governance

AI governance refers to the structure, processes and procedures that are implemented to achieve enterprise objectives and to guide, manage, and monitor the enterprise’s AI activities (IIA 2017c). A good AI governance approach (technology) is to ensure that AI activities and AI-related decisions and actions are in line with the value of the enterprise (Lipitakis and Lipitakis 2017; Schmitt 2022), ethics (Dignum et al. 2004; Dignum 2018), and social and legal responsibilities (Kingston 2017), and staff with AI responsibility should have the necessary skills and expertise. The application of AI technology is not only to collect and collate data, but also to make objective judgments on the data through automatic learning, so as to analyze the correlation between loose data (Hesami and Jones 2020). Internal auditing should monitor and adjust its strategy in real time to improve the chances of achieving the objectives of the enterprise’s AI-related activities. To improve the efficacy of AI governance, a sound accountability and supervision mechanism should be established to further strengthen the enthusiasm and responsibility of the related responsible person for AI activities and decision-making (Negnevitsky 2005; Pelletier 2017). By using activities with AI, enterprises can develop lasting competitive advantages (Lauterbach and Bonime-Blanc 2016). Continuous auditing and continuous monitoring of internal audits can also make AI monitoring more effective and efficient. An enterprise’s AI application requires employees with technical capabilities and professional knowledge. Employees, especially experienced managers with AI knowledge, must know how to interact with these AI devices to maintain the efficient operation of AI governance (Dignum 2018).

Data infrastructure and data quality

In the world of risk dynamics and network exposure, AI data infrastructure is particularly important. In particular, the control of data access, the privacy and security of information, and the integrity, correctness and reliability of data have made the responsibility of internal audit supervision increasingly more of challenge (IIA 2017b, c). AI-related communications and infrastructure are vulnerable to hackers. It is necessary to enforce data privacy regulations, strengthen privilege management, ensure user information security and privacy, and strictly impose network security policies and procedures to reduce the probability of attacks (Höppner et al. 1999; Kou et al. 2021a, b). An internal audit needs to conduct a strict audit on the hardware and software environment of the AI technology, and perform real-time monitoring and security testing on its servers, clients, software configuration, load management, patch management, and run-time configuration management at the same time, so as to provide the highest degree of security. As the AI system continuously is self-learning and exploring during its use, many potential risks are difficult to be eliminated completely in the early stages. Therefore, strengthening supervision is crucial for AI security, privacy, and ethics issues (Tredinnick 2017). The systematic and comprehensive function of AI technology reduces the error of enterprise data analysis, but incorrect data may deepen its misjudgment and may cause irreparable harm. The internal audit should strengthen the integrity and reliability of data in the AI application process, and further promote safe and reliable operations of the AI system.

The human factor

Human error is the most common cause of information privacy and security flaws. It mainly includes ethics and black box factors. The AI calculation model is designed and developed by humans. Due to human errors and biases, both calculation efficiency and the ability of the AI to provide expected results may be affected (Tredinnick 2017). An internal audit must confirm that all hardware/software have been tested in the AI environment and meet the standards, and the security of AI programs should also be evaluated (Scherer 2016). Furthermore, AI must be effectively tested to ensure that the results reflect the initial objectives set by the organization. An AI system is an artifact and replaces people to accomplish some objectives. Therefore, social, legal, and moral values must be incorporated into AI technology at all stages of development (Ekel et al. 2016; Negnevitsky 2005; Srinivasan and González 2022). However, with the expansion of enterprise AI activities, related black box objectives and activities or procedures become more important. AI can keep all the secret and hidden records intact and reduce the possible risks and disputes. Some examples include a review of AI development and implementation policies, processes, and procedures, verifying that black box data have been identified, reviewing those responsible for AI results, and confirming that they understand and can interpret the black box data (Inuiguchi et al. 2009; IIA 2017b, c).

Data exploitation methods

As information technology advances, users can easily access data through the Internet. The proliferation of data size not only provides users with sufficient information, but also brings forth some challenges for users (Hu et al. 2017; Zhou et al. 2020; Hsu et al. 2022b). For the not well-defined filed, users prefer to collect as much information as possible to comprehend the intrinsic condition. Unfortunately, not all of the collected information are relevant to the research domains. Thus, feature selection for exploiting inherent knowledge from the stored data and strengthening data quality turn out to be an imperative requirement for a decision-making procedure. The rough set approach (RSA) introduced by Pawlak (1982), is a mathematical procedure to cope with data full of uncertainty, vagueness, and inaccuracy. The method (i.e., RSA) has been demonstrated its usefulness in data exploitation and been widely applied to numerous fields with satisfactory feedback, such as knowledge discovery, feature selection, outlier detection, etc. (Chao et al. 2018; Szeląg et al. 2014; Karami et al. 2014; Zhang et al. 2019; Zhang 2020; Hu et al. 2021a, b). However, traditional RSA determines a pair of lower and upper approximations by performing the set-inclusion relation and the non-empty set-overlapping condition (Atmaca and Karadaş 2020). Based on the aforementioned concepts, no acceptance and rejection errors are allowed during the decision-making procedure (Li et al. 2020). When it comes to handling a large-scale dataset, this method lacks flexibility and practicability. In addition, traditional RSA also cannot handle data with performance-ordered domains (Szeląg et al. 2014). To combat this, the literature has introduced the dominance-based rough set approach (DRSA) that takes prominence-ordered information into consideration with superior performance in many fields, such as loan fraud detection (Bizarro and Dorian 2017), spare parts classification (Ekel et al. 2016), and service strategy formulation (Liou 2011). Due to the merits of DRSA, this study utilizes this method as a data exploitation technique to filter out redundant and irrelevant messages so as to gain much deeper insights into an analyzed task.

A hybrid FMRDM model

This study uses the hybrid FMRDM framework (see Fig. 3) that integrates FCM, DRSA, FDEMATEL, and modified-VIKOR to evaluate how to effectively implement and enhance the internal audit procedure under AI applications so as to achieve sustainable development of enterprises. We choose DRSA, because of its two essential advantages over other techniques: (1) it requires a preference order in terms of exemplary decisions that are very intuitive and easy to be given by users, and (2) its inherent decision logics can be expressed in “if (condition)…, then (decision)…” format, which allows one to control the decision process and to execute a transparent decision-making procedure (Szeląg et al. 2014; Hu et al. 2017). In addition, the knowledge bases have a rule expression that makes it possible to intuitively describe exploited messages for humans to conduct further examination as well as increase practical applications (Greco et al. 1999; Zhang 2020). However, DRSA is a type of supervised learning method. When DRSA analyzes the data, the decision attribute has to be decided beforehand.

Fig. 3

The conceptual structure of a hybrid FMRDM

In line with Thangavel et al. (2005) who set up the k-means algorithm (i.e., hard clustering, which works well on compact clustering and strongly discriminant groups of data) to determine decision attributes for RSA, this study extends the flexibility of k-means by integrating fuzzy set theory with it. For cases that belong to two or more groups, it may be more suitable to assign them with gradual memberships to avoid coarse-grained assignments of data (IIA 2017a; Zhou et al. 2020). This method is called fuzzy k-means clustering (FKM). After data exploitation by joint utilization of FKM and DRSA, the selected data are fed into FDEMATEL to establish an influential relationship network and to analyze complex internal auditing problems under AI. By considering the practical experiences of experts, FDEMATEL determines whether the interactive influence relationship is effective through observing the degree of interaction among factors/criteria.

This study introduces the basic ANP concept into FDEMATEL to determine the influence relation matrix, to construct the influential network relationship map (INRM), and to identify the influential weights—(called “global weights”) of the FDEMATEL-based ANP (analytic network process) (FDANP) dimensions and criteria. FDANP can accurately and effectively measure the main influencing factors (influence weights) of an internal audit under AI, imports the influence weight of each criterion into the modified-VIKOR method, replaces “max–min” with “aspiration-worst” as the benchmark for calculation of the performance gap ratio, and measures the performance value of each criterion. Its purpose is to confirm the gaps in each criterion, to see how to improve these gaps so as to achieve the targeted level, and to determine the optimal internal audit framework under AI. Embracing the concept of a model ensemble, auditors thus gain a much deeper insight of AI applications in the internal auditing process with fewer biases, further yielding a direction for public sectors to realize how to align the current structure of regulatory filings with actual application needs. Figure 4 displays the FMRDM introduced herein. A detailed description of each process is illustrated as follows.

Fig. 4

An integrated model of hybrid FMRDM for AI internal business audit adoption

Stage 1: finalized questionnaire establishment by joint utilization of FKM and DRSA

Step 1: Decision variable determination by FKM. Clustering aims at grouping the data, by relying on similarities and dissimilarities of the analyzed instances, and has been successfully applied in many data explanatory fields, such as text mining, speech recognition, image analysis, etc. The k-means is one of the most common clustering techniques and is still widely applied nowadays. The validity of this method, though, degrades when dealing with data without a specific boundary (that is, when analyzed instances involve over-lapping regions of data) (Zhou et al. 2020).

To overcome this weakness of k-means, the fuzzy version of k-means, called fuzzy k-means (FKM), applies a partition matrix to assess the membership grades of each pattern belonging to each cluster so that the overlapping regions can be aptly defined and described (Nayak and Misra 2019; Eghtesadifard et al. 2020). A brief illustration of FKM runs as follows (Zhou et al. 2020). Assume a dataset with $B$ attributes $A = \left[ {a_{1} ,a_{2} , \ldots ,a_{B} } \right]^{T} \in \Re^{B \times M} ,{\mathbf{a}}_{i} \in \Re^{M} (i = 1, \ldots ,B)$ is grouped into $C$ clusters $H_{1} , \ldots H_{C}$. The corresponding prototypes of clusters can be displayed as $V = \left[ {v_{1} , \ldots ,v_{c} } \right]^{T} \in \Re^{C \times M} ,v_{k} \in \Re^{M} (k = 1, \ldots ,C)$. The objective function of FKM is to minimize the following equation (Kou et al. 2021a, b).

$$\begin{aligned} & J_{FCM} (U,V) = \sum\limits_{i = 1}^{B} {\sum\limits_{k = 1}^{C} {u_{ik}^{m} d_{ik}^{2} } } \\ & subject\;to \\ & U \ge 0,\;\;U{\mathbf{1}} = {\mathbf{1}},\;\;and\;\;U^{T} {\mathbf{1}} > 0 \\ \end{aligned}$$

(1)

We note that ${\mathbf{1}}$ denotes a column vector with all the elements set to one, and the difference between attribute $x_{i}$ and prototype $v_{k}$ is represented as $d_{ik}$. One of the popular distance measures used in FKM is the Euclidean distance ($d_{ik} = \left\| {x_{i} - v_{k} } \right\|_{2}$). The partition matrix is represented as $U = \left[ {u_{ik} } \right]_{B \times C}$, where $u_{ik}$ illustrates the degree of attribute $a_{i}$ belonging to cluster $H_{k}$. Moreover, $U \ge 0$ means that all the elements of $U$ are equal to or no less than zero. The shape of the membership function is handled by a fuzzification coefficient $m$. By an iterating procedure, the optimal value of $J_{FCM} (U,V)$ can be reached (Zhou et al. 2020).

$$\begin{aligned} & u_{ik} = \left[ {\sum\limits_{l = 1}^{C} {\left( {\frac{{d_{ik} }}{{d_{il} }}} \right)^{{\frac{2}{(m - 1)}}} } } \right]^{ - 1} ,\;\;i = 1, \ldots ,B,\;\;k = 1, \ldots ,C \\ & v_{k} = \frac{{\sum\nolimits_{i = 1}^{B} {u_{ik}^{m} x_{i} } }}{{\sum\nolimits_{i}^{B} {u_{ik}^{m} } }},\;\;k = 1, \ldots ,C \\ \end{aligned}$$

(2)

After determining the decision variable by performing FKM, the results are then fed into DRSA to filter out redundant information and maintain useful messages to formulate a pre-test questionnaire.

Step 2: Extraction of essential features by DRSA. Assume the data table is the 4-tuple information system $IS = (G,Q,V,f)$, where $G$ is a finite set of instances, $Q = \left\{ {q_{1} , \ldots q_{m} } \right\}$ is a finite set of criterion, $V_{q}$ is the domain of criterion $q$, $V = \bigcup\nolimits_{q \in Q} {V_{q} }$, and $f:U \times Q \to V$ is an information function. An information system is called an ordered information system, meaning that it considers a decreasing or increasing preference among criteria. In this system, $\ge_{a}$ expresses the preference-ordered relation based on criterion $a$. For example, if $k \ge_{a} t$, then $k$ dominates $t$ in $a$, expressed as $kD_{{R_{a} }} t$; if $t \ge_{a} k$, then $k$ is dominated by $t$ in $a$, expressed as $tD_{{R_{a} }} k$. Let $IS = (G,Q,V,f)$ be an ordered information system, and $D_{{R_{a} }}$ represents the dominance relation with respect to $a$ that can be displayed in Eq. (3).

$$D_{{R_{a} }} = \left\{ {(x,y) \in G \times G\left| {f(x,a)} \right. \ge f(y,a),\forall a \in A} \right\}$$

(3)

Here, $\forall a \in A$, two essential sets of object $x$ can now be derived (Li et al. 2018, 2020).

• (a) A set of objects dominating $x$, called A-dominating set:$D_{{R_{A} }}^{ + } (x) = \left\{ {y \in G\left| {yD_{{R_{A} }} x} \right.} \right\}$

• (b) A set of objects dominated by $x$, called A-dominated set:$D_{{R_{A} }}^{ - } (x) = \left\{ {y \in G\left| {xD_{{R_{A} }} y} \right.} \right\}$

In an ordered information system with decision variable set ${\text{(G,Q}} \cup b{\text{,V,f)}}$, the decision variable set $b$ can be used to divide $G$ into a finite volume of classes $Cl = \left\{ {Cl_{t} ,t \in T} \right\}$ and $T = \left\{ {1, \ldots ,n} \right\}$. Each $x \in G$ belongs to a specific decision class $Cl_{t}$. For each decision variable $v_{{d_{t} }}$, the volume of classes can be represented as $Cl_{t} = \left\{ {x \in G\left| {f(x,d) = v_{{d_{t} }} } \right.} \right\}$. Due to the preference order in $Cl$, the sets to be estimated do not belong to specific classes, but rather upward unions and downward unions of the classes, respectively.

$$Cl_{t}^{ \ge } = \mathop \cup \limits_{s \ge t} Cl_{s} ,\begin{array}{*{20}c} {} \\ \end{array} Cl_{t}^{ \le } = \mathop \cup \limits_{s \le t} Cl_{s} ,t = 1, \ldots ,n$$

(4)

The dominance-based rough set approach (DRSA) is structured below (Hu et al. 2017; Liou 2011).

• The lower and upper approximations of the upward union $Cl_{t}^{ \ge }$ are:

  $$\begin{gathered} \underline{{R_{A} }} (Cl_{t}^{ \ge } ) = \left\{ {x \in G:D_{{R_{A} }}^{ + } (x) \subseteq Cl_{t}^{ \ge } } \right\}; \hfill \\ \overline{{R_{A} }} (Cl_{t}^{ \ge } ) = \left\{ {x \in G:D_{{R_{A} }}^{ - } (x) \cap Cl_{t}^{ \ge } \ne \phi } \right\} \hfill \\ \end{gathered}$$

• The lower and upper approximations of the downward union $Cl_{t}^{ \le }$ are:

  $$\begin{gathered} \underline{{R_{A} }} (Cl_{t}^{ \le } ) = \left\{ {x \in G:D_{{R_{A} }}^{ - } (x) \subseteq Cl_{t}^{ \le } } \right\}; \hfill \\ \overline{{R_{A} }} (Cl_{t}^{ \le } ) = \left\{ {x \in G:D_{{R_{A} }}^{ + } (x) \cap Cl_{t}^{ \le } \ne \phi } \right\} \hfill \\ \end{gathered}$$

The corresponding boundary regions of $Cl_{t}^{ \ge }$ and $Cl_{t}^{ \le }$ are represented in Eq. (5).

$$\begin{aligned} & Boundry(Cl_{t}^{ \ge } ) = \overline{{R_{A} }} (Cl_{t}^{ \ge } ) - \underline{{R_{A} }} (Cl_{t}^{ \ge } ) \\ & Boundry(Cl_{t}^{ \le } ) = \overline{{R_{A} }} (Cl_{t}^{ \le } ) - \underline{{R_{A} }} (Cl_{t}^{ \le } ) \\ \end{aligned}$$

(5)

By joint utilization of FKM and DRSA, the finalized questionnaire can now be established. For more detailed illustration of DRSA, please see Greco et al. (1999) and Li et al. (2018).

Stage 2: measure the degree of mutual influence among evaluation indices based on the FDEMATEL technique

Step 1: Construct the initial relation matrix Z. An integer scale from 0 (no satisfaction) to 4 (very strong satisfaction) in this study rates the degree of satisfaction. The initial relation matrix Z (called an average matrix) was directly constructed through 34 experts with practical experience using a pairwise comparison, as shown in Eq. (6):

$${\varvec{Z}} = \left[ {\begin{array}{*{20}c} {z_{11}^{{}} } & \cdots & {z_{1j}^{{}} } & \cdots & {z_{1n}^{{}} } \\ \vdots & {} & \vdots & {} & \vdots \\ {z_{i1}^{{}} } & \cdots & {z_{ij}^{{}} } & \cdots & {z_{in}^{{}} } \\ \vdots & {} & \vdots & {} & \vdots \\ {z_{n1}^{{}} } & \cdots & {z_{nj}^{{}} } & \cdots & {z_{nn}^{{}} } \\ \end{array} } \right]$$

(6)

Step 2: Normalize the direct-effect matrix D for the criteria. The normalized direct influence relationship ${\varvec{D}} = [d_{ij} ]_{n \times n}$ can be derived from the direct influence relation matrix ${\varvec{Z}} = [z_{ij} ]_{n \times n}$ by Eqs. (7) and (8):

$${\varvec{D}} = \phi \cdot {\varvec{Z}}$$

(7)

$$\phi = \min \left\{ {\frac{1}{{\max_{1\; \le i \le n} \sum\nolimits_{j = 1}^{n} {z_{ij} } }},\frac{1}{{\max_{1\; \le j \le n} \sum\nolimits_{i = 1}^{n} {z_{ij} } }}} \right\}$$

(8)

Step 3: Calculate the total influence matrix T. The total influence relationship matrix ${\varvec{T}} = \left[ {t_{ij} } \right]_{n \times n}$ is obtained from:

$${\varvec{T}} = {\varvec{D}} + {\varvec{D}}^{2} + \cdots + {\varvec{D}}^{l} = {\varvec{D}}({\varvec{I}} - {\varvec{D}}),\quad {\text{when}}\;\;\mathop {\lim }\limits_{l \to \infty } {\varvec{D}}^{l} = \left[ {\mathbf{0}} \right]_{n \times n} ,$$

(9)

where ${\varvec{D}} = [d_{ij} ]_{n \times n}$, $0 \le d_{ij} < 1,$ $0 < \sum\nolimits_{i = 1}^{n} {d_{ij} } ,$ and $0 < \sum\nolimits_{j = 1}^{n} {d_{ij} } \le 1.$

Step 4: Construct the INRM. The study applies the total influence relation matrix T to analyze the relationship between the influence (direct and indirect) vector ${\varvec{d}} = (d_{i} )_{n \times 1}$ (the sum of rows $\left[ {\sum\nolimits_{j = 1}^{n} {t_{ij} } } \right]_{n \times 1} = ( \ldots ,d_{i} , \ldots )^{\prime}$ in the influence matrix T), and the affected vector ${\varvec{s}} = (s_{i} )_{n \times 1}$ (the sum of columns $\left[ {\sum\nolimits_{i = 1}^{n} {t_{ij} } } \right]^{\prime }_{1 \times n} = ( \ldots ,s_{j} , \ldots )^{\prime}$ in the influence matrix T), when $i = j$ is established. The vector (d + s) indicates the degree of the total influences among criteria/dimensions, where each criterion (factor) simultaneously influences others and is affected by others. In addition, the vector (d—s) indicates the degree of causality among criteria/dimensions. In general, when (d—s) is positive, then the criterion i or dimension i influences other criteria/dimensions more than it is influenced. By contrast, if (d—s) is negative, the criterion i or dimension i is influenced by other criteria more than it influences others.

Stage 3: derive the DANP influential weights of criteria/dimensions

Step 1: Determine the unweighted supermatrix. First, the total influence relationship matrix ${\varvec{T}}_{C}$ is composed of each dimension (cluster), as shown in Eq. (10).

(10)

Here, ${\varvec{T}}_{C}^{ij}$ is a submatrix. Next, the total influence relationship matrix ${\varvec{T}}_{C}$ is normalized, and the normalized total influence matrix ${\varvec{T}}_{C}^{\beta }$ with respect to the total degree of influence can be derived from Eq. (11).

(11)

The total influence relationship matrix T is therefore composed of interdependent clusters/dimensions, as the matrix ${\varvec{T}}_{C}^{\beta }$ for the normalization of Eq. (12). The transpose of ${\varvec{T}}_{C}^{\beta }$, the unweighted supermatrix $W = (T_{C}^{\beta } )^{^{\prime}}$ is defined using Eq. (12).

(12)

Step 2: Find the weighted super-matrix ${\varvec{W}}^{\beta }$. First, the total dimension influence matrix ${\varvec{T}}_{D}$ is derived by the DEMATEL model, as shown in Eq. (13).

$$\user2{\rm T}_{D}^{{}} = \left[ {\begin{array}{*{20}c} {t_{D}^{11} } & \cdots & {t_{D}^{1j} } & \cdots & {t_{D}^{1m} } \\ \vdots & {} & \vdots & {} & \vdots \\ {t_{D}^{i1} } & \cdots & {t_{D}^{ij} } & \cdots & {t_{D}^{im} } \\ \vdots & {} & \vdots & {} & \vdots \\ {t_{D}^{m1} } & \cdots & {t_{D}^{mj} } & \cdots & {t_{D}^{mm} } \\ \end{array} } \right]_{m \times m}$$

(13)

The normalized matrix ${\varvec{T}}_{D}^{\beta }$ is obtained from the normalization of influence relationship dimension matrix ${\varvec{T}}_{D}$, where each elements is divided by $d_{i} = \sum\nolimits_{j = 1}^{n} {t_{D}^{ij} }$ in this matrix, as shown in Eq. (14).

$$\user2{\rm T}_{{\text{D}}}^{\beta } = \left[ {\begin{array}{*{20}c} {t_{D}^{11} /{\text{d}}_{1} } & \cdots & {t_{D}^{1j} /d_{1} } & \cdots & {t_{D}^{1m} /d_{1} } \\ \vdots & {} & \vdots & {} & \vdots \\ {t_{D}^{i1} /d_{i} } & \cdots & {t_{D}^{ij} /d_{i} } & \cdots & {t_{D}^{im} /d_{i} } \\ \vdots & {} & \vdots & {} & \vdots \\ {t_{D}^{m1} /d_{m} } & \cdots & {t_{D}^{mj} /d_{m} } & \cdots & {t_{D}^{mm} /d_{m} } \\ \end{array} } \right]_{m \times m} = \left[ {\begin{array}{*{20}c} {t_{11}^{\beta D} } & \cdots & {t_{1j}^{\beta D} } & \cdots & {t_{1m}^{\beta D} } \\ \vdots & {} & \vdots & {} & \vdots \\ {t_{i1}^{\beta D} } & \cdots & {t_{ij}^{\beta D} } & \cdots & {t_{im}^{\beta D} } \\ \vdots & {} & \vdots & {} & \vdots \\ {t_{m1}^{\beta D} } & \cdots & {t_{mj}^{\beta D} } & \cdots & {t_{mm}^{\beta D} } \\ \end{array} } \right]_{m \times m}$$

(14)

The weighted super-matrix ${\varvec{W}}^{\beta }$ can then be easily obtained:

(15)

Here, $t_{ij}^{\beta D}$ is a scalar, and $\sum\limits_{j = 1}^{m} {m_{j} = n}$.

Step 3: Incorporating the fuzzy set theory into DEMATEL. The fuzzy set theory has been widely conducted to handle the vagueness of human thought and expression in a decision-making task. One of the effective approaches called linguistic terms can be much more appropriate in estimation when it comes to tackling uncertainties in the process of decision-making (Zadeh 1975; Özkan et al. 2020; Kou et al. 2021a, b). Linguistic terms can be expressed by fuzzy numbers, and the most commonly applied is triangular fuzzy number (see Table 1). To solve the problem of group decision-making in an uncertain environment, the fuzzy aggregation approach is considered. When users conclude their decision findings that involve linguistic variables (i.e., fuzzy numbers), the defuzzification approach is extremely needed to transform fuzzy numbers into crisp scores. Converting fuzzy data into crisp scores (CFCS), as proposed by Opricovic and Tzeng (2004), aims to identify the left ($l$) and right ($r$) scores by fuzzy minimization and fuzzy maximization function, and the total score is decided by the weighted average approach. To capture the ambiguity of human assessments, the linguistic variable “influence” is applied with five linguistic terms as {no, weak, medium, strong, very strong} that are depicted in triangular fuzzy numbers $(l_{ij} ,m_{ij,} r_{ij} {)}$, as shown in Table 1. Based on the linguistic measures derived from experts, we obtain the fuzzy direct-influence matrix ${\tilde{\mathbf{Z}}}$.

$${\tilde{\mathbf{Z}}} = [\tilde{z}_{ij} ]_{n \times n} ,\quad {\text{where}}\;\;\begin{array}{*{20}c} {\tilde{z}_{ij} = (z_{ij}^{l} ,z_{ij}^{m} ,z_{ij}^{r} )} \\ \end{array}$$

(16)

Table 1 The linguistic scale for the influence of criteria (Opricovic and Tzeng 2003)

Based on the fuzzy direct-influence matrix, we can derive the normalized fuzzy direct influence matrix:

$$\begin{aligned} & {\tilde{\mathbf{D}}} = {\tilde{\mathbf{Z}}}/u,\quad {\text{where}}\;\;u \\ & \quad = \mathop {\max \left\{ {\mathop {\max }\limits_{i} \sum\limits_{j - 1}^{n} {z_{ij} ,} \mathop {\max }\limits_{j} \sum\limits_{j - 1}^{n} {z_{ij} } } \right\}}\limits_{i,j} ,\quad i,j \in \{ 1, \ldots ,n\} \\ & {\tilde{\mathbf{D}}} = {[}\widetilde{e}_{ij} {]}_{n \times n} ,\quad \widetilde{e}_{ij} = \left( {e_{ij}^{l} ,e_{ij}^{m} ,e_{ij}^{r} } \right) \\ \end{aligned}$$

(17)

The normalized fuzzy direct influence matrix ${\tilde{\mathbf{D}}} = (D^{l} ,D^{m} ,D^{r} )$, where $D^{l} = [e_{ij}^{l} ]_{n \times n} ,\begin{array}{*{20}c} {} \\ \end{array} D^{m} = [e_{ij}^{m} ]_{n \times n} ,\begin{array}{*{20}c} {} \\ \end{array} {\text{and}}\begin{array}{*{20}c} {} \\ \end{array} D^{r} = [e_{ij}^{r} ]_{n \times n}$. When the identity matrix ($I$) is further taken into consideration, we can obtain the fuzzy total influence matrix (${\tilde{\mathbf{T}}}$).

$${\tilde{\mathbf{T}}} = [\tilde{t}_{ij} ]_{n \times n} ,{\text{where}}\begin{array}{*{20}c} {} \\ \end{array} \tilde{t}_{ij} = (t_{ij}^{l} ,t_{ij}^{m} ,t_{ij}^{r} )$$

(18)

where ${\mathbf{T}}^{l} = [t_{ij}^{l} ]_{n \times n} = {\mathbf{D}}^{l} ({\mathbf{I}} - {\mathbf{D}}^{l} )^{ - 1} ,{\mathbf{T}}^{m} = [t_{ij}^{m} ]_{n \times n} = {\mathbf{D}}^{m} ({\mathbf{I}} - {\mathbf{D}}^{m} )^{ - 1} ,$ and ${\mathbf{T}}^{r} = [t_{ij}^{r} ]_{n \times n} = {\mathbf{D}}^{r} ({\mathbf{I}} - {\mathbf{D}}^{r} )^{ - 1}$, respectively. The total fuzzy influence matrix ${\tilde{\mathbf{T}}} = [\tilde{t}_{ij} ]_{n \times n}$ can be transformed (that is, defuzzified) into crisp total influence matrix ${\mathbf{T}} = [t_{ij} ]_{n \times n}$ via a CFCS adoption.

Step 4: Find DANP influential weights (global weights). By limiting the weighted super-matrix, that is, the super-weighted matrix through self-multiplication to a sufficiently large power q among the assessment criteria until a stable super-matrix emerges, the global weights $(w_{1} , \ldots ,w_{j} , \ldots ,w_{n} )$ of FDANP are thus derived from $\mathop {\lim }\limits_{q \to \infty } ({\varvec{W}}^{\beta } )^{q}$.

Stage 4: compare the performance gap of AI applications in an internal audit using a modified VIKOR method

Step 1: Calculate the normalization of the initial rating matrix. This study replaces the traditional VIKOR approach of “Max–Min” by the modified VIKOR of “Aspiration-Worst”, which is used to measure the performance matrix of AI application in internal auditing. In the modified VIKOR, the performance scale of the positive ideal (aspiration level) is defined as $f_{j}^{aspiration} = 10$, and the worst value (lowest score) is defined as $f_{j}^{worst} = 0$ (Li et al. 2018). Accordingly, the performance gap ratios $\left[ {r_{pj} } \right]_{P \times n}$ are measured through the normalized performance matrix $\left[ {f_{pj} } \right]_{P \times n}$, as shown in Eq. (19).

$$[r_{pj} ]_{P \times n} = {{[\left( {\left| {f_{j}^{aspiration} - f_{pj} } \right|} \right)} \mathord{\left/ {\vphantom {{[\left( {\left| {f_{j}^{aspiration} - f_{pj} } \right|} \right)} {\left( {\left| {f_{j}^{aspiration} - f_{j}^{worst} } \right|} \right)}}} \right. \kern-\nulldelimiterspace} {\left( {\left| {f_{j}^{aspiration} - f_{j}^{worst} } \right|} \right)}}]_{P \times n}$$

(19)

where the vector $\, {\varvec{f}}^{aspiration} = (f_{1}^{aspiration} ,...,f_{j}^{aspiration} ,...,f_{n}^{aspiration} )$ denotes the aspiration level and the vector $\, {\varvec{f}}^{worst} = (f_{1}^{worst} ,...,f_{j}^{worst} ,...,f_{n}^{worst} )$ denotes the worst value.

Step 2: Measure the minimal mean of group utility $S_{p}$ and maximal regret $Q_{p}$. Both of them can be calculated using Eqs. (20) and (21).

$$L_{p}^{h = 1} = S_{p} = \sum\limits_{j = 1}^{n} {w_{j} r_{pj} } = \sum\limits_{j = 1}^{n} {w_{j} (} |f_{j}^{aspiration} - f_{pj} |)/(|f_{j}^{aspiration} - f_{j}^{worst} |)$$

(20)

$$L_{p}^{h = \infty } = Q_{p} = \max_{j} (r_{pj} |j = 1,2,...,n)$$

(21)

where $r_{pj} = (f_{j}^{aspiration} - f_{pj} |)/(|f_{j}^{aspiration} - f_{j}^{worst} |)$ indicates the performance gap ratio, and $S_{p}$ indicates the ratios of the average gap from aspiration level $f_{j}^{aspiration}$ to real performance value $f_{pj}$ in each criterion j of each alternative (company) p. The main issue in this study is how to minimize the performance gap ratio ($r_{pj} ,j = 1,2, \ldots ,n.$) of alternative p.

Step 3: Find the comprehensive performance indicator $R_{p}$. The integrated values are calculated from:

$$R_{p} = v(S_{p} - S^{aspiration} )/(S^{worst} - S^{aspiration} ) + (1 - v)(Q_{p} - Q^{aspiration} )/(Q^{worst} - Q^{aspiration} )$$

(22)

Using $R_{p}$, the highest priority of the performance gaps can be identified.

Research design and result analysis

Questionnaire development and data collection

This study’s questionnaire development process consists of three major steps. In the first step, we follow the guidance on the AI internal audit framework (IIA 2017a, b, c, d) issued by the most credible organization in the internal audit domain, called Institute of Internal Auditors (IIA), and extend this framework by reviewing related literatures (Bizarro and Dorian 2017; McCollum 2017; Pelletier 2017). From detailed evaluation, discussion, and literature reviews, we summarize the collected data, represent them in a hierarchical structure, and set up four dimensions and 23 criteria (that is, preliminary questionnaire) (see Table 2). We invited ten chief audit executives or heads of internal audit department and 8 senior engineers of enterprises with imported AI technology from Guangzhou and Shenzhen to fill out the preliminary questionnaire.

Table 2 The criteria used in the preliminary questionnaire and finalized questionnaire

The rule-based data exploitation approach with the nature of being intuitive and easy-to-use has become one of the most welcoming ones in essential feature identification. This study takes DSRA as a benchmark and compares it with the other three rule-based approaches: rough set approach (RSA), decision tree (DT), and classification and regression tree (CART). However, the aforementioned data exploitation approaches belong to the group of supervised learning. Thus, a decision variable has to be decided first.

Thangavel et al. (2005) performed the clustering approach to determine the decision variable for RSA, and so this study compares two clustering approaches to determine the best setting for DRSA. The numbers of clusters can be viewed as a decision variable, and clustering can be converted into a traditional task whereby the converted data are fitted into the aforementioned supervise learning algorithms. Table 3 indicates that k is set to 3 for obtaining the best performance (i.e., this setting reaches the highest value of the summation of coverage and accuracy). By joint utilization of FKM and DRSA, the essential criteria can be exploited (see Table 3) to form a finalized questionnaire.

$$\begin{aligned} & Coverage(Rule) = A_{{{\text{cov}} ers}} /\left| D \right| \\ & Accuracy(Rule) = A_{correct} /\left| D \right| \\ \end{aligned}$$

(23)

Here, $A_{{{\text{cov}} ers}}$ represents the number of instances covered by the rule; $A_{correct}$ denotes the number of instances precisely discriminated by the rule; and D expresses the training data set.

Table 3 The comparison results under two scenarios

With 14 criteria left over from the 23 criteria, the finalized questionnaire ranges from 0 to 10 points, with a high score indicating greater importance. According to Saaty (1996), this is consistent with a limited number of factors within a single dimension to ensure consistency and effectiveness. Table 3 displays the effectiveness of DRSA in data exploitation fields. In this study, only 18 instances are considered. To further validate our finding, we enlarge our instances by utilizing synthesized minority oversampling technique (SMOTE), which is performed in Waikato Environment for Knowledge Analysis (WEKA) software. The DRSA and RSA can be downloaded from Laboratory of Intelligent Decision Support Systems webpage and Rough Set Exploration System webpage, respectively. By considering dissimilar settings for multiplication on instances, we can reach a much more trustworthy and reliable outcome. To prevent the result just happening by coincidence, we consider the Friedman test, which is a type of statistical examination. We see that the introduced approach outperforms the other three approaches (see Table 4).

Table 4 The compared results of four approaches (The clustering approach is FKM)

The finalized questionnaires were finally sent to 12 heads of internal auditing departments and 12 senior engineers in China’s listed companies and to 10 scholars in IT-related department from Guangdong (such as Guangzhou and Shenzhen), who are quite familiar with the application of AI auditing. Each completed questionnaire from August 2020 to February 2021 through online/offline interviews took about 80–90 min. According to experts’ opinions/thoughts, they assessed the satisfaction of each criterion on another criterion. The scale of the score was from 0 to 4 with 0 being no satisfaction and 4 being very strong satisfaction. The results of the questionnaire survey can be served as the basis for our empirical analysis.

Creation of INRM using the FDEMATEL

We apply a hybrid FMRDM model to calculate the aspiration levels and the worst value (called “aspiration-worst”) as benchmarks to replace the traditional “max–min” benchmark in order to pursue continuous improvements and reduce performance gaps. In brief, the FDEMATEL technique is mainly used to construct the influential relationship matrix and INRM from a questionnaire survey of experts. The FDANP influential weights are then found to solve practical problems using the ANP concept because ANP is better able to solve real-world problems than AHP (analytic hierarchy process). The performance value of alternatives is measured based on the modified VIKOR approach in Sect. 3 (Stage 3). The empirical analysis is illustrated in Fig. 5.

Fig. 5

The process of the empirical case

We invited 34 experts with a background in IT and auditing from Guangzhou and Shenzhen to score the dependence of each criterion on the others, and the initial influence matrix ${\tilde{\mathbf{Z}}}$ by pairwise comparison. After the initial influence relationship matrix ${\tilde{\mathbf{Z}}}$ is normalized through Eq. (17), a direct influence relation matrix ${\tilde{\mathbf{D}}}$ can be determined. We apply Eq. (18) to derive the fuzzy total impact relationship matrix ${\tilde{\mathbf{T}}}$ (Table 5) in order to identify INRM.

Table 5 Fuzzy normalized direct influence relation matrix T for the criteria (average)

Table 6 shows that, of the four dimensions, dimension A (AI application strategy) has the highest degree of influence ($d_{i} - s_{i} = 0.047$), whereas dimension C (data infrastructure and data quality) and dimension D (the human factor) are influenced by other dimensions. The strongest total influence relationship with other criteria ($d_{i} + s_{i}$) is calculated for criterion $b_{3}$ (AI accountability and oversight) at 1.224, whereas the value of $d_{3}$ (the black box) is 0.396 with the weakest relationship. In the criteria assessment of artificial intelligence adoption for internal auditing, criterion $a_{4}$ (AI cognition of senior executives) has the highest ($d_{i} - s_{i}$), representing that this criterion has the strongest influential power affecting other criteria. Criterion $a_{2}$ (AI outcomes and expected level) had the lowest ($d_{i} - s_{i}$) among all the criteria, showing that it is easily influenced.

Table 6 Sum of cause $d_{i}$ and effect $s_{i}$ influence among dimensions and criteria

This study constructs the INRM of dimensions and criteria by measuring the degree of mutual influence among the four dimensions and 14 criteria with the FDEMATEL technique. In Fig. 6, the horizontal axis indicates the total relationship between variables ($d_{i} + s_{i}$), and the vertical axis indicates the degree of causality between variables ($d_{i} - s_{i}$). INRM allows us to grasp more clearly the interdependence between dimensions for the application of artificial intelligence in China’s internal auditing. For example, as shown in Fig. 6, dimension A (AI application strategy) confirms its direct effect on other dimensions; dimension B (AI governance) also has a solid influence on dimensions C (data infrastructure and data quality) and D (human factor). Consequently, this study demonstrated that a robust AI application strategy and AI governance of internal auditing are the most determinant aspects for corporate sustainable development. Dimensions C and D are below the horizontal axis denoting that they are effective and affected (not causal) dimensions. An analysis of the straightforward network influence relationships among criteria within the dimensions suggests that criteria $a_{4}$ (AI cognition of senior executives), $b_{4}$ (necessary skills and expertise of AI responsibilities), $c_{2}$ (information privacy and security), and $d_{1}$ (AI test) have a major effect in each dimension. The four criteria of the framework are the kernel of their dimension, having a formidable effect on sustainable development and establishment of the criteria in their dimension.

Fig. 6

INRM of the influence network relation for 4 dimensions and 14 criteria

Evaluation of influential weights using FDANP

AHP assumes independence among criteria (inner clusters) and dimensions (outer clusters), however, it also identifies the relationship of dependence and feedback between dimensions and between criteria through a diagonal matrix until it can be conformed to be independent (null matrix) or a unit matrix (diag. (1,1,…,1)), with the weighted super-matrix obtained using equal weights (Rahiminezhad Galankashi et al. 2020; Hu et al. 2021a, b). FDANP influential weights among the criteria are based on ANP being conducive to the solution of real-world problems. The total influence relationship matrix $T_{C}$ and the normalized total matrix $T_{C}^{\beta }$ for the criteria (factors) are obtained from Eqs. (10) and (11). Using Eq. (12), that is, transposing the normalized total matrix $T^{\beta }$- we are able to calculate the unweighted supermatrix W, and to measure the total influence relationship matrix $T_{D}$ and normalized total matrix $T_{D}^{\beta }$ for the dimensions through Eqs. (13) and (14). The weighted super-matrix $W^{\beta }$ can then be derived from Eq. (15). Finally, the FDANP influential weights (called “global weights”) are obtained by limiting a sufficiently large number of times z (Table 7) to the super-weighted matrix through self-multiplication among the criteria, until it converges and emerges under a long-term stable situation. The global weights of FDANP can be transformed into local weights of the assessment criteria for the purpose of importing into the modified VIKOR for determining the performance gap ratio $r_{pj}$ of each criterion, as well as the overall assessment.

Table 7 Influential weights (global weights) of system factors by $\lim_{q \to \infty } (W^{\beta } )^{q}$

Calculation of performance using the modified VIKOR

As a big resource-sufficient nation, China has gained considerable attention due to its great impact on global financial markets. The China stock market also is one of the biggest financial markets for global investors. Thus, how to increase corporate reporting accountability and protect investors is an essential topic. Auditors have been widely viewed as the gatekeepers of financial reports. However, in this era of big data, auditors who perform limited audit procedures find it complicated to discriminate among essential information found within over-abundant data. Due to the merits of AI application in internal auditing, such as helping to form an appropriate judgment under an anticipated risk level, eliminating the possibility of audit failure, and deterring lawsuit problems, it has been widely adopted by publicly listed companies in China. In order to evaluate the performance of AI application in internal auditing, this research considers four companies that have adopted AI as an internal auditing technique for a long time. From the evaluation results, we can understand the performance gap of each criterion and the total performance gap of AI application in internal auditing for these evaluated institutions.

The benchmark modified VIKOR method using “aspiration-worst” is thus set as $f_{j}^{worst} = 0$ and $f_{j}^{aspiration} = 10$ in criterion j, where $j = 1,2, \ldots ,n$. The performance matrix (values) ${[}f_{pj} ]_{P \times n}$ applied to produce then the performance ratio-gap ${[}r_{pj} ]_{P \times n}$ are calculated based on Sect. 3, Eq. (16). This can avoid selecting the seemingly best solution among inferior options/alternatives (Liou 2011). The aspiration levels and worst values proposed in this study are defined as in Eqs. (17)–(18).

Following the above description, Table 8 lists the performance evaluation results from modified-VIKOR. Our approach sets an aspiration level (zero gaps) as a benchmark by the decision maker, and the weighted gaps indicate improvement room between the company (alternative) and the benchmark. The results can help a company unearth the disparities between current performance and target levels and identify improvement goals, effectively enhancing its competitiveness. Accordingly, our results reveal that company A₂ has the lowest total gap (0.276) among the four companies, showing that this company has the best effect in terms of AI application in internal audit as unanimously recognized by the panel of experts. It also means that its performance is the closest to the target.

Table 8 Gap ratio of AI in internal auditing by modified-VIKOR

The indicated gaps also demonstrate that data infrastructure and data quality (C) have the lowest performance gaps among all four companies. From the criteria, AI cognition of senior executives ($a_{4}$) achieves the highest gaps, while the necessary skills and expertise of AI responsibilities ($b_{4}$)- exhibit the second highest gap for the four companies. Thus, experts agree that corporates that have already adopted AI internal auditing, at present are the weakest in both aspects. Our model can also help companies achieve the desired level of each criterion and improve overall performance.

Discussions and implications

This study investigates the information aggregated from the opinions and knowledge of domain experts and employs FDEMATEL technology to construct INRM. Figure 6 illustrates the causal relationships among the systems (dimensions) and sub-systems (criteria) for assessing AI adoption in enterprises’ internal auditing. The priority of dimensions for improvement is AI application strategy (A), AI governance (B), human factor (D), and data infrastructure and data quality (C). The results mean that AI application strategy (A) has the most important and immediate influence relation on other dimensions. AI technologies provide a function fulfilling substitutes to a company’s existing products or instruments within the same market. In a corporate context, handling certain problems requires a particular characteristic to enhance human judgment and analysis, to assess and solve complex problems, and to make decisions (El Namaki 2018). Therefore, because of the extraordinary potential and advantages of AI technology, and by processing data that extract valuable information or applying data-oriented and knowledge-driven methods, the accuracy of senior management decision-making can be improved (Zhang and Yang 2019; Zhang 2020).

The structure and effectiveness of AI internal control stem from how an AI application strategy is supported by the enterprise (Länsiluoto et al. 2016; Sjödin et al. 2021). An AI application strategy should be linked to corporate goals, and both senior executives and technology professionals who need to understand the functions and limitations of AI can adopt and co-manage their implementation of AI activities (Inuiguchi et al. 2009). The unique characteristics of AI help entities capture more useful insights against a backdrop of big data, and using these insights improves the internal control effects and creates better corporate value. The criteria also disclose the same network effect within each dimension, such as AI cognition of senior executives ($a_{4}$), the necessary skills and expertise of AI responsibilities ($b_{4}$), information privacy and security ($c_{2}$), and AI test ($d_{1}$).

Among all criteria (factors), AI cognition of senior executives ($a_{4}$) exhibits the highest influence relation on other criteria. The advantage of AI here is that it optimizes a company’s solutions and value creation and thus supports the enterprise in the planning and execution of AI strategies, so that the internal audit work can be more efficiently and effectively implemented. Obviously, the issue of AI cognition of senior executives is the most important consideration for AI applications in China’s internal auditing sector. Senior management can thus consider the relationship between multiple solutions in order to develop a complete AI internal audit architecture.

The second highest impact among the criteria covers “the necessary skills and expertise of AI responsibilities (b₄)”. Professional and technical AI talents have insufficient knowledge about the expansion of the AI market, but the demand by enterprises for related talents will continue to increase over the next decade. The professional knowledge and skills of information department personnel are now key factors for providing assurance that normal operations of AI policies and procedures are implemented in organization. Thus, firms should target internal training to improve professionalism, competencies, and responsibilities of related personnel.

The third highest impact among the criteria covers “ability of the AI provider ($a_{3}$)”.When the AI model enters the stage of continuous delivery, continuous deployment, effect monitoring, and iterative update, the assistance of AI service providers with excellent technical capabilities is most needed. In order to link the entire cycle of AI-driven internal audit model from development to maintenance, it is even more necessary for AI service providers to collaborate closely. Sjödin et al. (2021) indicated that scalability refers to the AI provider’s ability to expand its initial AI solution and scope so that it can reach a larger market space and achieve economies of scale internally and externally. Consequentially, the empirical results of this paper serve as a practical reference for AI applications in corporate internal control systems. Table 9 lists the priorities for improvements of each criterion within each dimension.

Table 9 Strategic planning for improving performance based on INRM

The past studies of AI considerations for the profession of internal auditing are mainly narrative discussions (IIA 2017a, b, c), or used interviewing, observation and traditional statistical methods to conclude their findings (Baldwin et al. 2006; O’Leary and Watkins 1995; Omoteso 2012; Sutton et al. 2016; Alina et al. 2018). This study proposes an effective framework of AI-driven business audit and is proposed “AI cognition of senior executives” is the most important criterion.

Conclusion

This research proposes a systematic and reliable improvement project for accounting and auditing professions when they adopt AI in their internal audit process. Motivated by a model ensemble, a comprehensive decision framework established herein integrates FCM, DRSA, FDEMATEL, INRM, FDANP, and modified VIKOR. From the framework we can gain deeper insights into the internal audit process and explain the inter-relationships among the affected criteria/factors/indicators. To realize the cause-and-effect relationships among dimensions/criteria, we employ FDEMATEL. Relying on a dimension/criterion’s meaningful relationship with every other dimension/criterion, the leading and lagging dimension/criterion can be shown in INRM. Therefore, internal auditors can concentrate on the leading dimension/criterion, since their dimension/criterion improvement will trigger the enhancement of lagging dimensions/criteria.

The outcomes of FDEMATEL are sequentially fed into ANP (FDANP) to calculate the mutual influential weights of criteria so as to provide the influential weights for these enterprise’ AI-driven internal audit framework performance evaluation in the real business world. The modified VIKOR is conducted to avoid the problem of “choosing the best among inferior options/alternatives”. This method can handle the ranking and selection task, and it can further yield the performance gap improvement for each dimension and criterion by calculating the difference between aspiration levels and actual levels. This information helps internal audit managers realize their real performance and assist them in deploying resources to suitable places so as to reach the optimal level.

According to the opinions of domain experts, the priority of dimensions for improvement is AI application strategy, AI governance, data infrastructure, data quality, and human factors. The research methodology described herein is capable of dealing with complex dynamic issues related to the assessment of AI in China’s internal auditing industry. Not only do the research results offer implications for senior management, but even more importantly they can help in setting up a practical problem-solving strategy for a company’s sustainable development, thus assisting in the improvement of both quality and quantity of AI internal auditing.

While this study has created an empirical evaluation model, there are still some interesting ideas worthy of future research. The proposed evaluation framework in this study is based on IIA reports, and the selection of experts may not be considered comprehensively. Furthermore, although many companies in China adopt an AI-driven internal audit, their implementation quality is extremely varied. Future studies can consider extending the sample sizes or comparing the difference between government-owned and private-owned companies so as to provide better practical results. In addition, future studies can consider to apply much more advanced grouping strategies such as kernel-based clustering and group decision making approach, to dig out much more valuable indicators. They can also take the time-varying indicators into consideration to realize current and future development so as to reach a conclusion with academic and practical value.