Development of a Comprehensive Continuous Auditing Model for Risk Management in Iranian Commercial Banks

Abstract

Objective: The present study aimed to develop a comprehensive continuous auditing model with a focus on risk management in Iranian commercial banks.

Methods and Materials: This study employed a mixed-methods design (qualitative–quantitative). In the qualitative phase, the grounded theory approach based on Anselm Strauss and Juliet Corbin was utilized, while the quantitative phase complemented the analysis. The statistical population in the qualitative section consisted of 22 banking experts, including managers and heads of internal audit departments from Tejarat, Mellat, and Saderat banks, as well as academic specialists, who were selected through snowball sampling. In the quantitative section, the sample size was determined purposively and included 146 senior managers from the aforementioned banks in East Azerbaijan Province. Data collection tools included structured interviews (qualitative) and a questionnaire developed based on the qualitative model (quantitative). Data analysis in the qualitative phase was conducted using three-stage coding (open, axial, and selective coding), and in the quantitative phase through structural equation modeling (SEM) using SmartPLS version 3.1.1.

Findings: Qualitative analysis led to the development of a six-dimensional conceptual model, including causal conditions (risk identification and assessment, controls, and assurance), contextual conditions (infrastructure, human resources, and culture), intervening conditions (complexity, rate of change, data, security, and cost), the core phenomenon (continuous auditing with a focus on risk management), strategies (managerial, technological, and structural), and outcomes (risk reduction and managerial development). The results of the quantitative phase confirmed a good model fit and revealed significant relationships among the model dimensions; in particular, a strong and statistically significant relationship was observed between causal conditions and the core phenomenon, as well as between the core phenomenon and strategies, at a high confidence level.

Conclusion: The findings indicate that the successful implementation of continuous auditing and the achievement of optimal risk management in Iranian commercial banks require the identification and strengthening of enabling factors, proactive management of challenges, and the application of comprehensive strategies (managerial, technological, and structural). The proposed model provides an effective framework for enhancing supervision and promoting managerial development within the country’s banking system.