The Impact of Business Risk-Based Audit Approach on Reducing Unsystematic Risks: Evidence from Jordanian Banks

Abstract

This study aims to identify the impact of the audit approach based on business risks (i.e., external environment risk, operations risk, information risk) in reducing unsystematic risks (i.e., operational risk, credit risk, liquidity risk, capital risk, and administrative risk) in Jordanian banks. To reduce the effect of unsystematic risks and, thus, improve banking performance, an audit approach based on business risks has emerged. To achieve the objectives, this study relied on descriptive statistics and the regression approach to study twenty-five Jordanian banks. The researcher used the intentional sampling method represented by employees of the accounting, financial and control departments in Jordanian banks. Seventeen banks contributed to the study, with a percentage of 68%, totaling 356 employees. A questionnaire was designed to obtain the data, and due to homogeneity among the sampling members, a purposive sample was drawn and 300 questionnaires were distributed. The results of the study found a statistically significant effect of the audit approach based on business risks with its combined dimensions on reducing unsystematic risks in Jordanian banks. The results of the study also found a statistically significant effect of the business risk-based audit approach with its combined dimensions on reducing operational risks in Jordanian banks.

1. Introduction

The traditional function of auditing accounts is to impart more confidence in financial statements. Audit methods have evolved as indicated by previous studies (Higson, 2003; Gray and Manson, 2011) over four generations. The first generation is represented by examining records and financial statements from operations and balances. The second generation is called the Analytical Auditing or Systems Approach. The third generation is called the Audit Risk Approach and, finally, the fourth generation is called the Business Risk-Based Audit Approach.

The business risk-based audit approach emerged in the second half of the 1990s as a major innovation in audit methodology (Eilifsen, Knechel, & Wallage, 2001; Lemon, Tatum, Turley, 2000). This approach has been used by major auditing firms around the world, especially after the collapse of major international companies such as Enron, Arthur Anderson and Worldcom (Fogarty & Rigsby, 2010; Robson, Humphrey, Khalifa, & Jones, 2007). This approach focuses on the auditor learning more about the client’s strategies, operations and work environment, in order to understand whether the financial statements are presented fairly. This leads to improving the auditor’s ability to identify risks that directly or indirectly affect financial statements and know their effects (Curtis & Turley, 2007). The business risk- based audit approach also contributes to filtering risks that may affect financial statements to reduce errors in preparing financial statements (Johnstone, 2000). Knechel, 2007; William, 2003 outlined two significant points related to the process of examining an entity according to a business risk- based audit. Firstly, the auditors must define and understand the strategic management control techniques and operational processes. Secondly, the auditors, through their choice of risk control processes within the important and critical operational processes, should estimate the type and size of remaining business risks that may affect the accuracy and fairness of the financial statements.

Banks are generally exposed to many risks, whether they are systemic risks or unsystematic risks, in light of the many changes in the economic environment. The safety of the banking system in the form of risk management has become one of the most important priorities for banks of all kinds. It considers systemic risks as risks that have an impact on the economy as a whole, and which result from economic, social or political factors. Its effects are not limited to a specific sector, such as the risks of wars, interest rate changes, or the entry of the economy’s curve into a recession (Renn & Klinke, 2004), and it cannot be controlled. This type of risk, or its elimination, is the case in the unsystematic risks in question. As for the various types of unsystematic risks, they are internal risks that belong to the bank, which can be reduced by diversifying investment portfolios. A number of researchers have defined unsystematic risks as the risks that pertain to a specific company. Their effects can be reduced by diversifying various investments and their causes, such as inter-sector competition, wrong management practices, and workers’ strikes (Bansal, 201l; Mehrara, Falahati, & Zahiri, 2011). Banks are exposed to many risks, whether these are systemic or unsystematic. This is as a result of several factors, such as globalization, scientific and technological development, openness to global banking markets, the development of new financial tools, and the multiplicity and diversity of banking services. This is reflected in the size and nature of banking risks, which has become the focus of many parties; not only because of their impact on the bank, but also for their impact on society. In light of the increasing interest in reducing informal risks, the focus was on unsystematic risks represented by the following: operational risks, credit risks, liquidity risks, capital risks, and administrative risks. These can result from poor decision-making and wrong management practices. In order to control and reduce the effect of unsystematic risks (and thus improve banking performance and reduce the chance of financial hardship), an audit approach based on business risks has emerged. This leads to improving the auditor’s ability to identify risks that directly or indirectly affect financial statements, know their effects and treat them in a timely manner. It also helps reduce unsystematic risks, which in turn can affect the performance and credibility of financing and payment operations and various banking operations. This study focuses on answering this question: Is there an impact of the audit approach based on business risks with its combined dimensions (external environment risk, operations risk, information risk) in reducing unsystematic risks in Jordanian banks?

The remainder of the paper is structured as follows. Section 2 is the literature review. Section 3 outlines the theoretical framework and hypotheses. Section 4 presents the research methodology and, finally, the conclusion and recommendations are explained in Section 5.

2. Literature Review

2.1. Business Risks Audit Approach

The first group of previous studies focused on the

Business Risks Audit (BRA) approach. Abdallah, Mssadeh, and Othman (2015) measured the impact of the business risk-based audit approach on audit quality from the auditors’ point of view. This study explored the impact of systemic risks on the quality of the audit process from the auditor’s viewpoint. A study by Abdullatif and Al-Khadash (2010) aimed at discovering the applicability of the business risk- based audit approach in developing countries, especially in the Jordanian context. The study found that Jordanian audit firms have adopted the business risk-based audit approach. Robson et al. (2004) dealt with the audit approach based on business risks as an institutional event in the audit environment and the accounting profession in Britain. The authors found there was a need for auditors to take into account how the audit approach affects the business risks of the entity being audited. Ballou and Heitger (2002) aimed to measure the impact of business risk-based auditing on audit judgment and decision-making. The study reached a number of conclusions, including the need for auditors and researchers to take into account how the business risk-based audit affects the audits. De Martinis and Houghton (2019) examined the effect of the business risk audit approach on audit production efficiency in a major Australian public sector audit. Meanwhile, Kutum, Fraser, and Hussainey (2015) examined business risk audit from the standpoint of small- and medium-sized auditing firms in the UK, USA and Canada. The results are important, not only in relation to small- and medium-sized audit firms in the USA, UK, and Canada, but also because they allow for comparison with the results of previous studies involving big four audit firms and BRA.

Several studies have also indicated that a business risk- based audit is based on a set of dimensions, including external environment risks, operations risks, and information risks. Banham (2010) has defined external environmental risks as “a group of risks arising from external factors represented in the emergence of new or alternative products, technological changes, competition, and economic changes.”

The study carried out by Nastase and Unchiasu (2013) has defined operations risk as “a risk that arises from the ineffectiveness and efficiency of project operations, and is represented by financial risks, marketing risks, employee related risks, and the risk of losing reputation or goodwill. Kinney (2000) has defined information risk as the risk arising from the lack of accurate and correct information that helps in making correct decisions related to the activity or business, whether this information is related to the external environment or project operations.

2.2. Unsystematic Risks

A group of studies has focused on the unsystematic risks represented by operational risks, credit risks, liquidity risks, capital risks, and administrative risks. For example, Alelfartas (2019) investigated the relationship between internal corporate governance mechanisms and on unsystematic risks using data from thirteen commercial banks listed on the Amman Stock Exchange during the period 2009-2016. It concluded that internal corporate governance mechanisms variables have a significant effect on unsystematic risk. Widarjona, Anto, and Fakhrunnas (2014) investigated the determination of the optimal portfolio with regard to relations among stock returns of companies that are active in Tehran’s stock market. The results of factor analysis and factors identified returns as changes in independent companies. The optimal portfolio determined this way and non-systematic risk get at its minimal level. Arif and Anees (2012) examined liquidity risk in Pakistani banks to evaluate its effect on profitability. The study sample was twenty-two Pakistani banks, studied over a period of six years, from 2004 to 2009. The research found that there existed a significant negative relationship between liquidity, deferred loans, liquidity gap, and profitability. Al- Qudah (2017) explored the impact of internal control in accordance with COSO Commission’s decisions based on the analysis of credit risk according to the 5C’s approach in Jordanian Commercial Banks. The authors concluded that there exists a statistically significant impact of all internal control dimensions (i.e., regulatory environment, regulatory actions, risk assessment, information and delivery system, supervision, and guidance) on credit risk analysis in accordance with the 5C’s approach in all Jordanian commercial banks. Waemustafa and Sukri (2016) looked at the systemic and unsystematic risks of liquidity risk between Islamic banks and conventional banks. Their study found that Islamic banks have higher capital adequacy rates than conventional banks, and thus are less exposed to liquidity risks. Meanwhile, Hamdan (2015) aimed to test the effect of corporate governance principles on unsystematic risks in Jordanian commercial banks. The study found a statistically significant effect of corporate governance principles on unsystematic risks in Jordanian commercial banks.

Margono, Wardani, and Safitri (2020) found that capital adequacy and liquidity has a positive effect on bank performance, interest rate risk and credit risk can mediate capital adequacy on bank performance, interest rate risk can mediate liquidity on bank performance, and interest rate risk has a positive effect on bank performance. Malkiel and Xu (2003) found that unsystematic risks fluctuations can be related to the institutional owner. They also unveiled a positive relationship between unsystematic risks fluctuations and expected returns growth rate. In addition, Vozlyblennaia (2013) documented a non-significant statistical relationship between institution’s characteristics, book to market, leverage size, institutional ownership, earnings per-stock and turnover, and unsystematic risks. Dao and Nguyen, (2020) investigated the factors affecting the profitability of commercial banks in Asian developing countries, including Vietnam, Malaysia and Thailand. The research found the significantly negative relationship between operational risk and banking profitability, as well as the positive association between credit risk and banking profitability.

Unsystematic risks are based on a set of dimensions, namely, operational risk, credit risk, liquidity risk, capital risk, and administrative risk. A study carried out by De Jongh, De Jongh, De Jongh, and Van Vuuren (2013) defined operational risk as “the risk that results from weakness in internal control, from people, human resources, or as a result of external circumstances such as natural disasters, inadequate information systems and technical errors, weakness in the internal control systems and the occurrence of theft, which all lead to unexpected losses.” Sobehart and Keenan (2001) define credit risk as the risk that arises due to non-payment of the full amount borrowed by the customer at due date, resulting in a financial loss. The study also defined liquidity risk as the time during which banks are able to fulfill and pay their financial obligations in cash, while responding to requests for new loans and various other credit requests, and this in turn requires the availability of sufficient liquid cash, and their ability to obtain such liquid cash Ismail (2010).

Moussa and Aymen (2013) have defined the capital risk as “the non-availability of enough money to protect the rights of many parties, such as depositors or lenders, which exposes the credit grantor to potential losses, whether of short or medium term.” Hachad (2005) defined administrative risks as “the risks that result from making wrong decisions that may result in the loss of certain gains through alternative opportunities, or the bank’s failure to take decisions to manage its activities, which may lead to depriving the bank from achieving various gains or protecting it from the risks to which it may be exposed.”

3. Theoretical Framework and Hypotheses

3.1. Theoretical Framework

The study developed a research framework, shown in Figure 1. The proposed study model is based on a set of variables and proposed relationships between these variables, which can be illustrated as follows:

Figure 1: Study Framework

Source: The researcher’s model is based on Abdallah et al. (2015); 

Ballou and Heitger (2002); Alelfartas (2019); Hamdan (2015).

The research is based on the following axes:

1. Independent variable (Business Risks Audit approach). This variable was measured through the following dimensions: external environment risk, operations risk, and information risk. This is based on studies focusing on these dimensions (Abdallah et al., 2015; Abdullatif & Al-Khadash, 2010; De Martinis & Houghton, 2019). 

2. Dependent variable (Unsystematic Risk). This variable was measured through the following dimensions: operational risks, credit risks, liquidity risks, capital risks, and administrative risks. These dimensions were selected by surveying studies on this topic (Hamdan, 2015; Alelfartas, 2019; Arif & Anees, 2012).

3.2. Hypotheses

Based on the problem, objectives and model, the following hypotheses can be formulated:

H₀1: There is no significant difference at (0.05≥α)

for the Business Risks Audit approach and its combined dimensions (external environment risk, operations risk, and information risk) on reducing the unsystematic risk in Jordanian banks.

Branching off from this main hypothesis, the following sub-hypotheses can be made:

H₀1.1: There is no significant difference at (0.05≥α) for the Business Risks Audit approach with its combined dimensions on reducing operational risks in Jordanian banks.

H₀1.2: There is no significant difference at (0.05≥α) for the Business Risks Audit approach with its combined dimensions on reducing credit risks in Jordanian banks.

H₀1.3: There is no significant difference at (0.05≥α) for the Business Risks Audit approach with its combined dimensions on reducing liquidity risks in Jordanian banks.

H₀1.4: There is no significant difference at (0.05≥α) for the Business Risks Audit approach with its combined dimensions on reducing capital risks in Jordanian banks.

H₀1.5: There is no significant difference at (0.05 ≥ α) for the Business Risks Audit approach with its combined dimensions on reducing administrative risks in Jordanian banks.

4. Research Methodology

The current study relied on descriptive and inferential approaches in order to identify the impact of the business risk-based audit approach in reducing the unsystematic risk in Jordanian banks. This approach is based on an accurate and detailed interpretation of the problem by defining its conditions, components and dimensions, describing the relationships between them, analyzing data, measuring and interpreting them, and reaching an accurate description of problem in a comprehensive manner that may be useful in generalizing the facts that have been revealed. It also helps a reasonable amount of future prediction of the phenomenon and to provide solutions and proposals to address it.

4.1. Population & Sample

The study population consisted of all employees within internal audit and risk management departments in Jordanian banks. There are twenty-five banks in Jordan (Central Bank of Jordan website, www.cbj.gov.jo). Seventeen banks were included, representing 68% of the study population. Approximately 356 employees work in these banks. Due to the homogeneity among the population members, a purposeful sample was chosen and 300 questionnaires were distributed. 217 questionnaires were retrieved, four of which were excluded because of their invalidity and, thus, 213 questionnaires were valid for the purposes of statistical analysis. These questionnaires were representative of the study population according to the sample schedule developed by Sekaran and Bougie (2016).

4.1.1. Reliability

The reliability of the tool used to measure the variables included in the questionnaire has been verified by calculating the value of Cronbach’s Alpha coefficient, where the result is statistically acceptable if its value is greater than (0.70). Whenever the value approaches 1, i.e., 100%, indicates higher reliability of the study tool (Sekaran & Bougie, 2016).

Table 1: Reliability Coefficients of the Study Tool Based on Cronbach’s Alpha

Table 2: Normal Distribution of Data Based on (K-S)

The above table shows that the value of Cronbach’s Alpha ranged between 74.8% and 92.6%. We note that the value of Cronbach’s Alpha for all paragraphs is 94.5%, so the study tool can be considered reliable. The data obtained through it are suitable for measuring the variables as the values are than the acceptable percentage (70%) and are subject to a high degree of reliability.

4.1.2. Natural Distribution Test

The Kolmogorov-Smirnov test was applied to verify

whether the data fell under the normal distribution. One of the conditions for the normal distribution of this test is that the (Sig) value of the data shall be greater than (0.05), which indicates that the data fall within the normal distribution (Doane & Seward, 2011). The results are shown in Table 2.

The data shown in Table 2 indicate that the data distribution was normal, as the (Sig) value was greater than 5% for the study dimensions.

4.1.3. Multicollinearity

In order to ensure the availability of multicollinearity, the Variance Inflation Factor (VIF) and tolerance were calculated. Table 3 indicates that the tolerance of the independent variables was less than 1 and greater than 0.2. The Variance Inflation Factor values were less than 5. This indicates that there is no high correlation between the independent variables, which means that the values are accepted and that they are suitable for conducting a multicollinearity analysis (Hair et al., 2018).

To confirm the previous result, Pearson correlation coefficients were used between the dimensions of the independent variables to ensure that there was no high multicollinearity between them. The results are shown in Table 4.

Table 4 shows that the highest correlation between the independent variables is 0.625, which indicates the absence of multicollinearity between the independent variables, as their values are less than 80%. Therefore, the sample is free from the problem of high multicollinearity (Gujarati et al., 2017).

4.1.4. Autocorrelation Test

This test shows that the data is free from the autocorrelation problem in the regression model, which impairs the model’s predictability. This is verified with the Durbin-Watson Test, where its value is between 0 and 4.

Table 3: Multicollinearity Test Results Between Independent Variables

Table 4: Matrix of Pearson Correlation Coefficients for Independent Variables

Table 5: Results of (D-W) Autocorrelation for the Study Hypotheses

If the value of Durbin-Watson ranges between 1.5 and 2.5, this indicates that there is no autocorrelation problem. Table 5 shows the results of this test. It appears that the Durban- Watson value calculated for the study hypotheses is greater than 1.5 and less than 2.5 at a significance level of 5%, indicating the absence of the autocorrelation problem and its validity for use in the regression model (Hair et al., 2018).

4.2. Description of Variables

4.2.1. Business Risk-Based Audit Approach

This part of the study is concerned with describing the independent variable business risk-based audit approach in order to determine the extent to which it is applied to the viewpoint of the study sample. Means and standard deviation of the study sample responses were calculated regarding the business risk- based audit approach dimensions shown in Table 6.

It is evident from Table 6 that the means values of the dimensions of the independent variable (business risk- based audit approach) ranged between 4.19 and 4.42. The information risk dimension has scored the highest mean and a high degree of application. The external risk dimension scored the lowest mean and high degree of application. The general indicator of the business risk- based audit approach was 4.27, with a standard deviation of 0.521. Accordingly, it is evident that the degree of application of the business risk-based audit approach in Jordanian banks was of a high level.

4.2.2. Unsystematic Risks

This part of the study is concerned with describing the dependent variable, unsystematic risk, in order to determine the degree of application from the point of view of the study sample members. The mean and standard deviation of the study sample responses relied on regarding the dimensions of reducing the unsystematic risks, as shown in Table 7.

It is evident from Table 7 that the means values of the dimensions of the dependent variable (dimensions of mitigating unsystematic risks) ranged between 4.15 and 4.41. The dimension of mitigation of liquidity risks scored the highest mean and a high degree of application, while the dimension mitigation of credit risks scored the lowest mean with a high degree of application.

The general indicator for mitigating unsystematic risks was 4.26 with a standard deviation of 0.487. Thus, it becomes clear that the degree of application of mitigating unsystematic risks in Jordanian banks was within the high level.

Table 6: Arithmetic averages, standard deviations, and the degree of application towards the dimensions of the business risk-based audit approach

Table 7: Means, Standard Deviations, and the Degree of Application Regarding the Dimensions of Unsystematic Risks

4.3. Results of the Hypotheses

The hypotheses were tested using the Multiple Linear Regression test, and the results are shown in Table 8.

Table 8 shows the existence of a statistically significant effect for all the hypotheses, which appears through the value of F. Sig, which is 0.00 and, thus, less than 0.05. It is also shown through the value of calculated F, which is greater than its tabular value, which equals 2.60. The value of the correlation coefficient R for all hypotheses ranged between 0.573 and 0.794.

The value of R₂ ranged between 0.329 and 0.630. It appears from the results of the coefficients table that the dimension information risk scored the largest impact among the dimensions of the business risk-based audit approach in mitigating unsystematic risks and their dimensions. This appears through the calculated value of T, which is greater than its tabular value, and also through the Sig value, which is less than 0.05 for all hypotheses.

It was found that the dimension of operations risk had an impact on the dependent variable mitigating unsystematic risks, but not mitigation of liquidity risks, as the calculated value of T was less than its tabular value. The value of Sig was greater than 0.05. It was found that the dimension of external risk had an impact on the dependent variable mitigating unsystematic risks, but not mitigation of credit risks, mitigation of capital risks, or mitigation of administrative risks. The calculated values of T were less than its tabular value, in terms of value of Sig, which was greater than 0.05, as shown in Table 8.

5. Conclusion and Recommendation

This study provides new insights into the impact of the business risk-based audit approach in reducing the unsystematic risk in Jordanian banks. Our results contribute to the existing literature by demonstrating the importance of the role of the business risk-based audit approach in reducing unsystematic risks. The importance of this study lies in directing the attention of decision-makers in Jordanian banks to the role of the business risks-based audit approach in order to reduce the unsystematic risk; thus contributing to their survival, continuity and the achievement of their goals efficiently and effectively. The importance of this study also stems from its variables, which were examined in the audit approach based on business risks and unsystematic risks. These concepts have an important impact on improving and developing the performance of Jordanian banks, in addition to the lack of previous studies that linked the variables of the current study.

The results of this study have shown that the values of the means of the dimensions of the independent variable (business risk-based audit approach) ranged between 4.19 and 4.42, where the information risk dimension scored the highest mean and a high degree of application. This result is in agreement with Abdallah et al. (2015). The dimension of external risk scored the lowest mean and high degree of application. The general indicator of the business risk-based audit approach was 4.27, with a standard deviation of 0.521. Accordingly, it is evident that the degree of application of the business risk-based audit approach in Jordanian banks was of a high level. This result is in agreement with De Martinis and Houghton (2019). This study also found that the values of the means of the dimensions of the dependent variable (dimensions of mitigating unsystematic risks) ranged between 4.15 and 4.41. Moreover, the dimension of mitigation of liquidity risks scored the highest mean with a high degree of application. This result is in agreement with Arif and Anees (2012). Meanwhile, the dimension mitigation of credit risks scored the lowest mean and with a high degree of application.

In light of the results of this study, the following recommendations can be made. Firstly, it is necessary for Jordanian banks to provide special programs and technology to implement business risk-based internal auditing. Secondly, internal auditors in Jordanian banks should be given training in how to apply business risk-based auditing. Thirdly, this study recommends increasing training programs and workshops for individuals working in Jordanian banks on a systematic basis to identify risks, whether they are systematic or otherwise. Finally, this study recommends the continuous development of information systems so that internal auditors can communicate information about unsystematic risks in a timely manner.

Table 8: Results of the Study Hypotheses Test

* Significant at (0.05≥α)

Tabular F value = (2.60)

Tabular T value= (1.96)

Further research should use other measurements of unsystematic risk. This study also recommends the examination of the following topics:

- The impact of the business risk-based audit approach on the quality of the tax audit.

- The impact of unsystematic risk on the financial performance of companies listed in financial markets. - The impact of the business risk-based audit approach on the quality of external audits.

- The quality of internal auditing and its role in reducing operational risks in banks.