30 American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) ISSN (Print) 2313-4410, ISSN (Online) 2313-4402 © Global Society of Scientific Research and Researchers http://asrjetsjournal.org/ AuditModel: A Model for Representation of Continuous Audit Processes Based on ISO 19011 Allison Ramon Araújo de Santana a* , Paulo Caetano da Silva b a,b PPGCOMP – UNIFACS (Universidade Salvador) a Email: allison-valente@hotmail.com b Email: paulo.caetano@unifacs.br Abstract Objective of the study: The objective of this article is to propose a model of representation of audit processes that allows its automation, this model is based on ISO 19011, a standard recommended by the International Accreditation Forum (IAF). Methodology / approach: A study was carried out on the standardization of continuous audit processes. ISO 19011 was used as a reference to define the elements of the proposed model. After an analysis in the sections of the standard, sections 05 (establishing objectives of the audit program) and section 06 (conducting the audit) were selected to compose this work. Originality / relevance: The article contains quantitative data related to the performance of audits in Brazil and some limitations for carrying out audits. Through the model, the work makes up for the deficiency of the existence of documentation that helps the understanding, by software developers, auditors and companies, of how an audit should be carried out. It is expected to facilitate the development of audit software with the proposed model. Main results: 14 elements are specified, classified in 4 domains, which together make up the model for representing audit processes. A process is mapped and the specified elements are used to show how the audit processes are to be employed. Theoretical / methodological contributions: It seems feasible to use the methodology in different organizations, it is enough to understand the proposed model, internally map the processes to be audited and apply the concepts described in this work as an example. Keywords: AuditModel; Continuous Auditing; Audit Process Representation Model; ISO 19011; Audit Information Systems. ------------------------------------------------------------------------ * Corresponding author. American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2021) Volume 77, No 1, pp 30-47 31 1. Introduction The definition of continuous auditing already exists for quite a time. Vasarhelyi e Halper [1] defined continuous auditing as: “Methodology that allows independent auditors to provide a guarantee on a given subject, using audit reports, issued in real time or in a short period. These reports contain the occurrences of events adjacent to the subject”. The audit process must be carried out in a systematic manner, it must be documented and independent, aiming to obtain objective evidence (records, presentation of facts or other information) providing thus an assessment to determine the extent to which the criteria (set of policies, procedures or legal requirements) established by the organization are met [2]. The records and evidences of the internal audits must be presented to the certifiers during the audits. According to the survey The ISO Survey of Managent System Standard Certifications published in 2018 and carried out by ISO (International Organization for Standardization) [3], 1,307,622 (one million three hundred and seven thousand six hundred and twenty-two) were recorded management system certificates valid worldwide [3]. According to ISO, for these certificates to be considered valid, certifiers (independent companies) must carry out and maintain a cycle of three audits, two of which are for maintenance and one for renewal of certification. The records and evidence of the internal audits must be presented to the certifiers during the audits. According to a survey conducted by INMETRO (Instituto Nacional de Metrologia, Qualidade e Tecnologia - National Institute of Metrology, Quality and Technology of Brazil) [4] in the last 5 (five) years, in national territory, 27,700 (twenty-seven thousand and seven hundred) audits were carried out to validate or maintain Quality Management Systems (ABNT NBR ISO 9001) and 2,480 (two thousand four hundred and eighty) audits in Environmental Management Systems (ABNT NBR ISO 14001) [4]. Considering these data, 30,180 (thirty thousand one hundred and eighty) audits were carried out which were based on the application of the guidelines of the ABNT NBR ISO 19011 standard (Guidelines for Auditing in Management Systems) in the country. Mostly, external and internal audits are carried out using the traditional method. The auditor displaces himself to the audit location, obtains and evidences the service with the audit requirements, on-the-spot, manually and not automatically [46]. On-site audit costs use to be more expensive for the contracting organization, since it will be necessary to pay for accommodation costs, food and locomotion of the auditing team. However, the use of computation may interpret the data to be audited if they are legible to the machines, thus reducing the auditors' working time and, consequently, financial costs. To carry out internal audits in an automated manner, the organizations go through a transformation process, creating a digital and increasingly paperless environment [26]. The use of technologies in the process of carrying out audits can guarantee a better accuracy in monitoring and analysis, since rules can be defined by the auditor so that automatic alerts are made as anomalies are identified. There are divergent understandings regarding the automation process and materialization of the continuous audit. For automation to happen, several aspects must be considered, since the need for data standardization, to interoperability between computational environments [5] until the definition of models that describe how the audits must be carried out. The coherent definition of processes and standardization reduce rework and guarantee the reduction of errors, which can cause negative impacts on the organizational environment. Standardizing data for auditing helps to reduce problems: lack of accessibility, transparency of the data made available and / or collected, high cost in the act of data collection as well as efforts greater than necessary in various stages of the audit [6]. There are some initiatives for the standardization of audit data, one of the most significant examples is the Audit Data American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2021) Volume 77, No 1, pp 30-47 32 Standards [7], initiative of AICPA (American Institute of Certified Public Accountants) [8] whose objective is to develop a standardized data model that facilitates the use of improved analyzes. An AICPA working group developed audit data standards that identify the main information needed for audits and provide a common structure that covers: (1) data file definitions and technical specifications, (2) data field definitions and technical specifications, and (3) supplementary questions and data validation routines to help auditors better understand the data and assess its plenitude and integrity [8]. Patterns are offered in one of these two file formats: (1) simple file format (UTF-8 format of delimited text file) and (2) XBRL GL (Extensible Business Reporting Language) [9]. According to Flowerday and his colleagues [47], the variety of data formats and records generated by systems in use in organizations hinders the development of computational solutions focused on auditing. Apart from AICPA, there are few or almost none of the working groups that seek to create standards, norms and models focused on guidelines that enable the automation of the audit. From the perspective of understanding which steps should be followed and which guidelines should be considered as a requirement for the development of software projects with an audit focus, studies are even more scarce. About computer-assisted auditing techniques, audit software is classified into two categories: generalists (perform simulations, general sample analysis, summaries and duplication checks) and specialized (developed to perform specific and objective tasks, they are usually parameterized by the auditors themselves) [10]. These tools serve as instruments for the auditor to meet his planning and achieve his goals, regardless of the type of audit performed (internal or external) [11] . There are tools on the market such as Audimation [12] (risk analysis and assessment, conformity tests) [10], to Galileo [13] (risk management, documentation and reporting), to Pentana [14] (planning, time control, reporting and action plan control) [15] that make it possible to carry out an audit, however, are generalist tools. For Teruel, this type of tool does not need technical knowledge in auditing, they have pre-configured scripts [11]. In contrast, Lyra states that there is a decrease in the productivity of experienced auditors, which have a higher salary cost, when it is necessary to configure scripts in the audit tools [15]. According to traditional audit procedures (inspection of documentation, interviews) are time consuming for auditors and increase the chance of errors [36]. For Teruel, some audit tools are expensive, as well as its updates are propitious to errors due to the diversity of the characteristics of each tool [11]. According to Huanzhuo, when there is a need to guarantee requirements, not only for productivity, but also for adaptability, flexibility and interoperability, the term standardization is much discussed, both in public and private organizational spheres [27]. In view of the above, the following question is presented: is there a standardized model for representing audit processes that enables the standardized development of software for continuous auditing (CA)? For the authors of this work, the definition of a generic model for representing the audit process, based on a standard used on a large scale (ISO 19011) by many auditors in the world, enables the development of tools that are easy for the teams to understand, supplying the deficiency presented by Lyra [15] regarding the necessary settings before using some tools. The adoption by the developers of a generic model as a standard for the development of systems for auditing may reduce the development cost pointed out by [11] through the promotion and sharing of information in the academy and in public repositories. In addition, for Míkva and his colleagues models and standards provide the reduction of errors, improves security, facilitates and avoids communication problems [48]. Standardization enables companies to reduce their operating and financial costs. According to ISO there are currently 23,117 normative standards, developed by it, which cover almost all aspects of technology and manufacturing in the world, many of them are audited using the guidelines of ISO American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2021) Volume 77, No 1, pp 30-47 33 19011 which is generic and independent of the management system (e.g. quality, environment, work safety, information security) defined as an audit requirement [3]. Like the ISO, the model presented in this work proposes an independence of the information system in relation to the specific process audited and the requirements to be used in the audit. The representation of the audit process through the model will provide a standard structure that will allow, since the proposed elements are already used in the certification process, a greater coverage of the software regarding the service in different market segments (e.g. industry, agribusiness, logistics). Standardization of the representation of the audit process in information systems (IS) would make its execution more agile, without the need to configure scripts. Aiming to identify models and standards that enable the performance of automated audits was carried out the review of the literature called "Standardization of Audit Processes" [16], in which 97 standards were identified from five different organizations, which are: American Institute of Certified Public Accountants – AICPA [8], International Federation of Accountants - IFAC [17], Public Company Accounting Oversight Board – PCAOB [18], Conselho Federal de Contabilidade – CFC [19], Tribunal de Contas da União – TCU [20], the last two are Brazilian institutions. Although these standards had been created to assist in the audit process, only five (5.15%) of them seek to make a continuous audit possible, since, they focus on data extraction and manipulation. They are part of the Audit Data Standards [8] and were created with the intention of being only technical recommendations. The other ninety-two standards (94.84%) are related to the definition of concepts to be applied in the audit. As a result of this literature review, there is a lack of systematization of processes that assist in carrying out an automated audit and that is focused on its execution. Therefore, it is proved the need to create a representation model of the audit process in order to facilitate understanding as to the steps that must be followed to carry out the audit process and automate its execution. According to the IAF (International Accreditation Forum) [31] in its recommendation of guidelines for the application of ISO standards (IAF Guidance on the Application of ISO/IEC Guide 65:1996 [21], every certification organism must ensure that audits are carried out considering the normative items of ISO 19011 (Guidelines for Auditing in Management Systems) so that you can attest to the continued Conformity with the regulatory requirements of the certificate to be awarded, regardless of the type of audit (certification, maintenance or recertification). The expressiveness of the use of ISO 19011 in audits [22] and its recommendation by the IAF [21] made the authors of this work use this standard to compose the proposed process representation model. In this article are shown the concepts of Continuous Auditing and the ISO 19011 is discussed: Management System Audit Guidelines in the second section. The third section presents the representation model of the continuous audit process proposed in this work, in the fourth section a process is mapped as an example of the application of the proposed model. In conclusion, an analysis of the contribution of this work is made and possibilities for future studies are presented. 2. Theoretical foundation 2.1. Continuous audit Continuous audit consists of analyzing data, documents or records in order to identify inconsistency in the data obtained in real time or very close to the event [23]. The inconsistency evidenced during the audit process is called non- conformity, since, when the sample is compared with the normative requirement or rule in question, it differs from the conformity standard, that is, it does not meet the specified requirement. When a non- conformity is evidenced, this information is collected and presented in reports to provide an auditor's analysis, American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2021) Volume 77, No 1, pp 30-47 34 as well as the continuous improvement of the process. As important as obtaining non-conformities is the reflection to be carried out in search of the root causes of the event, in order to avoid the recurrence of failure [2]. Continuous auditing seeks to perform data analysis in small time frames or even continuously. Monitoring controls and operations in short periods of time allows the auditor to detect deviations quickly and efficiently, providing a brief and appropriate response for the organization. For Vasarhelyi and Chan [26] the continuous audit process consists of four steps: automation of the audit process (are identified and selected what organizational business processes will be audited and which data of each process must be presented to the audit team), data modeling and reference development (model or parameterize the data received in order to allow evaluations and audit tests), analysis of the data found and the emission of the audit report. The use of continuous audit methodologies can bring many benefits [32], such as:  Provide that the audit is more efficient, quick, effective and inexpensive;  Reduce the time between the performance of audits, focusing on the responses to the identified risks and bringing more reliability to the operations performed;  Make it possible to conduct audits more quickly, in less time, and can be performed in real time, daily, monthly or when necessary;  Test 100% of the data population. 2.2. ISO 19011: Guidelines for Audits in Management Systems (ABNT, 2018) In order to define necessary requirements for conducting, managing and conducting audits efficiently, with varying scopes and dimensions, ISO (founded in 1946 and present in 164 countries) developed the 19011 standard (Guidelines for Auditing in Management Systems) [2]. This standard formalizes in its structure the requirements that must be followed to perform the audit, these requirements are divided into sections:  Section 1: Defines the scope of the standard;  Section 2: Presents the normative references applicable in the act of revising or developing the standard;  Section 3: It has the terms and definitions applicable to the standard in question;  Section 4: Discusses the existence of the 7 (seven) principles of the audit: Integrity (foundation of professionalism), fair presentation (obligation to report accurately and truthfully, professional care (diligence and judgment in the audit), confidentiality (information security), independence (impartiality and objectivity), approach based in evidence and risk. These principles should guide the auditor to apply sections 5, 6 and 7 of the standard.  Section 5: Establishes objectives of the audit program (objectives, scope, criteria, staff, responsibilities, processes, resources and methods);  Section 6: Conducting the audit (preparing activities, critical analysis of documentation, planning audits, conducting audits, collecting information, determining conclusions and preparing audit reports)  Section 7: Competence and assessment of auditors (determining the competence of auditors, behavior, skills and assessments). American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2021) Volume 77, No 1, pp 30-47 35 In its section 5 (establishing audit program objectives) the standard introduces the concept of an audit program that seeks to assist in the process of planning and conducting one or more audits, thus enabling a better understanding of the application of normative items in the proper section 5 and section 6 (Conduct of the audit). In order to certify the conformity of organizations, raising the level of its products and services, ISO uses standard 19011 as a reference for the entire audit process in management systems. Only with the technical knowledge of its guidelines, after a rigorous evaluation, are certified auditors who have demonstrated competencies and skills defined in the standard. Auditors with the certification ISO 19011 can obtain the registration IRCA (International Register of Certificated Auditors) [24] and are trained to work with the certification process with Conformity Assessment Bodies (CAB) accredited by the General Coordination for Accreditation of Inmetro [4]. 3. Related works The related works presented in this article consider the literature review “Standardization of Audit Processes” conducted with the objective of knowing the available studies related to the standardization of continuous audit processes. Trindade [28] claim that ACM Digital Library and IEEE are influential repositories in the field of computing, composed of several journals and conference minutes. Considering the statement by [28], additional research was carried out in the IEEE, Scopus and ACM Digital Library repositories to complement this work. An artificial intelligence model is used to provide a bankruptcy forecast in organizations is proposed by Rodriguez and his colleagues [34]. The model considers variables such as risk, liquidity, profitability, among others. The study ponders the benefits of using new formats for representing financial data, e.g. XBRL-JSON and XBRL-CSV, and to create effective models for machine learning. Models for creating XBRL financial reports are presented by Charles Hoffman on the Mastering XBRL-based Digital Financial Reporting website [35]. Chapters 04, 05 and 06 consider issues related to models and examples for XBRL. In chapter 4 (Example and Samples - Template Examples) are presented the necessary rules and logic for conformity of the information in the financial reports, as well as signals the existence of 75 rules that make up financial disclosure models. In chapter 5 (Technical Details - Reconciliation of Models) the author analyzes the concepts of the SBRM (OMG Standard Business Report Model) [25], US GAAP / SEC (US GAAP, 2020) and the XBRL Abstract Model 2.0 (XBRL International Inc, 2012) in order to conceptualize the logic of using these models in XBRL. Still in chapter 5 the author presents 10 tips to assist in the modeling and creation of taxonomies. A study by Luciano, JG and his colleagues [38,39] on the SPED project that made it possible to create a data model based on XBRL GL, which could facilitate the ongoing audit processes for SPED. M. Werner illustrates and presents information that can contribute to financial audits. It presents a map and process flows, as well as their abstractions in order to facilitate the understanding of auditing [36]. M. A. Vasarhelyi and his colleagues [26], proposes an audit methodology in seven dimensions (Frequency of audits, proactive audit, audit automation, role of auditors, changes in audits, data modeling and audit schedules), as well as a paradigm for auditing with four steps (automation of audit processes, data modeling and development of reference measurements to be used in data analysis, data analysis and emission of reports). Based on a model for the application of continuous auditing in SOA, S. Chen and his colleagues [27] presents how data extraction should be and what are the possible modules and resources to be implemented in the application. In the work of [37] a model for internal audit is presented, the authors propose four phases: Definition of audit criteria, data analysis, American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2021) Volume 77, No 1, pp 30-47 36 automatic auditing and reporting. It was not possible to evidence the development of tools that validate the proposed model, as well as the definition of elements for carrying out an audit based on normative items. It was proposed by Santana and his colleagues a data representation model that enables the execution of automated auditing. In addition to the model, the use of a tool for continuous auditing is foreseen. [29] Codesso and his colleagues [45] in the article Continuous audit model data integration framework proposes the development of a framework to integrate different continuous auditing systems, whose objective is the standardization of data through XBRL technology for the continuous auditing process. 4. Auditmodel: A model of representation of continuous audit process Codesso and his colleagues in the article The representation model of the audit process presented in this section aims to supply the need to configure scripts in audit tools, which decrease the teams' productivity [15]. According to Werner, the use of technology in the audit enables the reduction of errors and increases the production of auditors [36]. Thus, the proposed model seeks to encourage the standardization of audit information systems, in academia and in public repositories for the development of open source tools, since audit tools tend to have high costs [11]. Models and standards reduce operating costs, avoid communication problems, improve security and reduce errors [48]. The knowledge about terminologies known to auditors, such as those presented in section 5 (establishing audit program objectives) and section 6 (Conducting the audit) of the 19011 standard and used to define the elements of this model, facilitates the development of tools with more user-friendly interfaces for auditors. The model presented is composed of 14 elements defined due to its importance for carrying out audits, they were organized in 4 domains. The domains were defined to classify the elements in groups to facilitate the reader's understanding of the purpose of each element. Domain blocks also refer to the phases to be performed during a macro audit process: Identification (internal or external), Planning (process, responsible, local), Conformity (requirements, evidence) and Reports (conclusion, future actions). The elements of the model represent the information that must be provided in the audit process and were specified considering nomenclatures that are already used by auditors. Examples of these nomenclatures are: audit scope (definition of where the audits are carried out), records (documents to be audited), criteria (requirements to be verified), audit reports (contains evidenced non-conformities), action plan (describes the activities to be performed to remedy non- conformity), among others. To better understand the purpose and limitations of each terminology, as well as to organize and standardize them in the audit process, the 4 domains were defined. The audit identification (internal or external, association of the audit to a plan to be followed) is represented by the Identification domain, the action plan, in the model, is composed of a set of elements that make up the Planning domain, the analysis of the conformity is carried out in the Conformity domain. It is through the domain of conformity that is defined the element that must contain the document to be audited and to allow its comparison with the defined audit criteria. The audit report and the action plan make up the Report domain. That is, the domains seek to classify the elements of the model in a simple and practical way. The UML modeling language [40], used in the AuditModel specifications (Figure 1 - Domains existing in the model and Figure 2 - Domains and their elements) it defines the “communications”, called relations (association, aggregation, composition, inheritance and dependence), which can occur between the elements, in order for one component to collaborate with another. In AuditModel, Relationships of Composition and Aggregation were identified. Composition happens when there is a dependency relationship between one component and the other, that is, for one American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2021) Volume 77, No 1, pp 30-47 37 component to exist, it needs the other. Aggregation is understood by a relationship that there is no such dependency, the component is added to another component. Both relationships are of the Association type [40]. Multiplicity is the number of objects with which the other object is associated. These association quantities can receive values of just zero, one or many, one or many, zero or one, or defined intervals. It is important the understanding of the purpose of each element of the model and the correlation between the domains, which can be seen in Figure 1 (Domains existing in the model). Closed lozenges (black) represent Composition, open lozenges (white) represent aggregation. Figure 1: Domains existing in the model The purpose of each domain is presented below:  Identification: Identify the audit or audit module within a system. In this domain, it is possible to highlight which type of audit will be carried out and associate it with a specific audit plan. In this domain, it is defined whether the audit is routine, conformity analysis or even a reanalysis to validate a previous analysis. It consists of three elements: ObjectiveAudit, AuditTechnique and AuditPlan.  Planning: The whole necessary structure for planning the activities to be performed is presented. Its elements aim to enable the creation of a plan (targeted and strategic) that is used as a basis for carrying out the audit. Through this domain it is possible to define the period, which is the process that will be audited, the type of audit to be performed, who are responsible for the audit and which will be the criteria to be used. Its structure is formed by six elements: ProcessActivitie, ScopeAudit, PeriodAudit, TypeAudit, ResponsibilitiesAudit and CriterionAudit.  Conformity: It has the function of attesting, through evidence, the conformity of a sample when compared to the requirements established in the audit plan. Its elements are: Conformity, DocumentAnalises and the CriterionAudit element, obtained through the Planning Domain.  Report: It is where the results of the audit are presented, and it is responsible for communicating the evidence to those involved, as well as the respective non-conformities evidenced in the audit process. Its three elements are: ReportRecomendation, LogFindings and ActionPlan. American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2021) Volume 77, No 1, pp 30-47 38 The relations [40] in Figure 1 are: Composition, between the Planning and Identification domains, occurs due to the need, in the identification of the audit, to title an “audit plan” that will be composed of the elements of the Planning domain. These elements have details that enable the formal scheduling of the audit process to be carried out. Another relation of composition is necessary between the domains of Planning and Conformity, therefore, to carry out the analysis of conformity, where it will be necessary to analyze the criteria and audit and compare them with the information to be validated. An aggregation exists between the Conformity domains and the Reporting domain, as the reports aggregate information from non-conformities and criteria used in the audit process by the Conformity domain. As for multiplicities, Figure 1 shows that the Identification domain can be used without the need for a Planning domain associated with it (0 ... *), but a planning domain mandatorily must have an identification (1...1). The Planning domain can have several conformities analyzes, through the Conformity domain (0 ... *), but conformity only occurs if there is planning (1...1). The Conformity domain may not need to generate a report through the Report domain (0 ... *), however, the Report domain must have at least one conformity analysis (1 ... *). Domains can be used in an independent way, for example: An organizational process to be audited can be defined in the Identification domain and an action plan registered in the Planning domain, however, the Conformity domain may not be activated and, consequently, the Report as well, since the scheduled audit did not happen. In Figure 2 (Domains and their elements), the elements of each domain are shown, which are discussed in the following sections. For a better association between the elements and their respective domains when the elements are cited in the text, they will be referenced with the same sequence as shown in Figure 2. The specifications of each element will also follow the illustrated numbers. Figure 2: Domains and their elements 5. Domain of Identification 5.1. AuditTechnique It represents the audit technique and exists due to the fact that it considers that other models may be proposed based on other auditing standards denominating the technique used. In this work, it assumes the value of ISO American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2021) Volume 77, No 1, pp 30-47 39 19011. Since the other elements are references of this standard. 5.2. ObjectiveAudit It determines the purpose of the audit to be performed. Three values have been pre-defined that can be used in this element and separated into levels.  Level 1: Routine Verification (Detect routine transaction irregularities that call attention);  Level 2: Conformity Check (aims to compare the defined criteria with the evidence collected);  Level 3: Reanalysis Verification (Perform the audit process again in order to verify the consistency of the data obtained). 5.3. AuditPlan It exists due to the need, in the identification of the audit, to name the “audit plan”, which must contain details that enable the formal programming of the audit process. This plan consists of the six elements to be presented in the Planning domain. 6. Domain of Planning 6.1. ProcessActivite Defines the business process that will undergo document analysis. 6.2. TypeAudit Defines whether the audit is internal or external. Internal audits are those performed by the organization's own auditing team, in contrast, external audits are carried out by outsourced companies, by the client or even by a certifier. 6.3. ScopeAudit It has the function of defining the scope and limits of the audit, in this element it is necessary to define which are the hierarchical levels that will be audited (Operational or Strategic), as well as the confidentiality of the documents that will be analyzed and generated. 6.4. PeriodAudit Defines the schedule for the execution of the audit, a date and a time for the audit to take place; 6.5. ResponsabilitiesAudit Delegates those responsible who will legally answer for the audit, the auditor who will sign the final report to be sent to those involved. American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2021) Volume 77, No 1, pp 30-47 40 6.6. CriterionAudit Defines the element used as a reference to perform the audit, which can be normative items, internal procedures or process criteria. 7. Domain of Conformity 7.1. Conformity Confront the criterion with the identified documentation in order to show Non-Conformities in the samples (anomalies); 7.2. DocumentAnalises Contains instances of the documents to be critically analyzed. Only predefined data types can be selected for analysis. 8. Domain of Reporting 8.1. LogFindings Records the logs of evidenced Non-Conformities; 8.2. ReportRecomendation Contains the identification of the audited document, the evidenced Non-Conformities, the CriterionAudit element corresponding to the assigned Non-Conformity; 8.3. ActionPlan Describes the ProcessActivitie, the ResponsibilitiesAudit, attaches the ReportRecomendation and signals the deadline for resolving the evidenced non-conformities. The existing relationships between the elements of the domains, illustrated in Figure 2, are all composition since AuditPlan (1.3) is part of the composition of the Planning domain (2). The elements DocumentAnalises (3.2) and CriterionAudit (2.6) make up the element Conformity (3.1), as well as the elements and ReportRecomendation (4.2) and ActionPlan (4.3) are made up of elements that exist in LogFindings (4.1). The multiplicities that count in Figure 2 show that an audit plan can have only one identification in the Identification domain (1) (1..1). However, the assignment of an identification via AuditPlan (1.3), for a future plan to be completed, can occur without the need to define an audit plan with all the elements of the Planning domain (2) (0 .. *). As for the elements DocumentAnalises (3.2) and CriterionAudit (2.6) , they can exist and be used without performing a conformity analysis Conformity (3.1) (0 .. *) but the conformity, mandatorily depends on a criterion and a document for it to be carried out (1..1). LogFindings (4.1) depends on the execution of the conformity analysis Conformity (3.1) to be generated and the elements ReportRecomendation (4.2) and ActionPlan (4.3) are composed of the data existing in the logs of these records. The elements proposed in this model were defined and conceptualized based on sections 5 (establishing American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2021) Volume 77, No 1, pp 30-47 41 objectives of the audit program) and 6 (Conducting audits) of the ISO 19011 standard. However, AuditModel is an extensible model, allowing new definitions to be added. Due to their importance, the elements proposed in the model are mentioned in several items and sections of the standard, for this reason, elements 1.2 (audit objective), 2.6 (audit criterion), 3.1 (conformity) and 4.2 (recommendation report) have more than one reference. Other items can be correlated with other sections of the standard other than sessions 5 and 6. 9. Example of the logical application of the proposed model To have a better understanding of the audit process model presented in the previous chapter, a business process was mapped. The name of the organization to which the process belongs will not be revealed, but the process is called Corporate Card Purchase Control and will be shown in Figure 3 (Mapping the corporate card control process).The corporate process presented was mapped using BPMN (Business Process Model and Notation) [25] with the purpose of presenting the flow of execution of the control of purchases made on the organization's card. This card is made available to employees who must account for the expenses incurred, as written in the internal procedure, following some pre-defined guidelines by management. Figure 3: Mapping the corporate card control process. Through the presented business process diagram, it is possible to identify the name of the process (Corporate card control) and the sector to which it belongs (financial). The macro process is divided into two internal sub- processes, sectors or actors that participate and interact with each other, in the example they are Carrier and Cost Center. The flow represented by the yellow lines leads to the actions expected after each interaction of the previous task. It is important to note that, the Assign Limit and Accountability activities use notations that represent requirements that must be followed for the flow to be completed successfully. In the description of this process, the limit assigned to a card made available by the organization is =