The Relationship Between Internal Control Quality and Audit Risk: Developing a Ranking Model for Iranian State-Owned Companies with Emphasis on Managerial and Supervisory Factors

Abstract

This study aimed to explain the relationship between internal control quality and audit risk and to develop a context-specific ranking model for Iranian state-owned companies with particular emphasis on managerial and supervisory factors. This applied-developmental study employed an exploratory sequential mixed-methods design. In the qualitative phase, 18 semi-structured interviews were conducted with experts and analyzed using thematic analysis, resulting in 48 initial indicators across six dimensions. In the second phase, the indicators were refined through two rounds of fuzzy Delphi, reducing them to 37. The final questionnaire was administered to the target population and 214 usable responses were obtained. Content validity was assessed using CVR and CVI, while reliability and construct quality were evaluated using Cronbach’s alpha, AVE, and CR. In the third phase, fuzzy AHP was used to determine the relative weights of dimensions and indicators, and fuzzy TOPSIS was applied to rank 37 state-owned companies from five major industries. The final fuzzy Delphi agreement coefficient was 0.82. The overall Cronbach’s alpha was 0.894, with dimension-specific coefficients ranging from 0.768 to 0.876. All 37 indicators had mean scores significantly above 3. Managerial factors received the highest normalized weight of 0.287, followed by supervisory factors at 0.241 and organizational factors at 0.164. Practical support from senior management was the most important indicator, with a global weight of 0.0531. Fuzzy TOPSIS classified two companies as critical risk, six as high risk, eight as medium risk, and 21 as low or very low risk. Exact agreement between the model and independent expert judgments was 75.6%, increasing to 91.9% when one-category differences were accepted. Internal control quality in state-owned companies is primarily driven by managerial and supervisory conditions, and strengthening senior management support, internal audit independence, audit committee effectiveness, and accountability mechanisms can reduce audit risk; the proposed model also provides a practical basis for company ranking and risk-based allocation of audit resources.