Methodology for Quantifying the Materiality of Audit Evidence Using Expert Assessments and Their Ranking

An Information security audit is a process of obtaining objective audit evidence and evaluating it objectively for compliance with audit criteria. Given resource constraints, it's advisable to focus on obtaining evidence that has a significant impact on its effectiveness when developing an audit program to organize the audit. The person managing the audit program faces an urgent task developing an audit program, taking into account the information content of extracted evidence and resource constraints. In practice, evidence cannot be evaluated correctly directly in numerical scales, so they are forced to use less informative scales. The purpose of scientific research is to develop a methodology for assessing the materiality of audit evidence using expert assessments, their statistical processing, and transition to quantitative scales. As a result, the person managing the audit program gets a tool for developing an effective audit program.

I. Introduction

A decision-maker in a particular field of activity needs management information that reliably reflects the state of the management object and the environment. However, at the time of making a decision, the decision-maker [1] is in a state of information uncertainty, since he does not have such information and can build his strategy only on guesses and intuition, which leads to an unreasonable decision and, more often, ineffective. To justify their decision, this person is forced to take measures to extract the missing information, which consumes management resources.