EXAMINING TECHNOLOGY RISKS FROM COSO PERSPECTIVE: A CASE STUDY ON AUDIT AND ASSURANCE IN AN ISLAMIC FINANCIAL INSTITUTION IN MALAYSIA

Abstract

The purpose of this study is to examine technology risks from the perspective of the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control–Integrated Framework within an Islamic Financial Institution (IFI) in Malaysia. Specifically, the study evaluates how governance structures, Enterprise Risk Management (ERM), Shariah Governance, the Institute of Internal Auditors (IIA) Three Lines Model, and the Global Internal Audit Standards (GIAS 2024) support technology risk management, internal control effectiveness, audit assurance, and regulatory compliance. ABC Islamic Bank (ABC-IB) was selected as the case study because of its well-established governance framework and significant digital banking operations. A qualitative case study approach was adopted using annual reports, corporate governance reports, audit committee reports, enterprise risk management disclosures, regulatory announcements, and enforcement actions issued between May 2024 and 2025.The study analyses technology-related incidents involving regulatory reporting, Central Credit Reference Information System (CCRIS) data integrity, digital banking service disruptions, operational resilience, and potential Shariah Non-Compliance (SNC) exposure by mapping these issues against the five components of the COSO Internal Control Framework. This happened because monitoring controls did not detect reporting errors before they reached the regulator indicate that the bank has established a comprehensive governance structure supported by the Board of Directors, Audit Committee, Risk Management Committee, Shariah Committee, Enterprise Risk Management, Internal Audit, and dedicated Technology and Cyber Risk Management Frameworks. Nevertheless, regulatory enforcement actions reveal weaknesses in Information and Communication, Control Activities, Monitoring Activities, and Risk Assessment, particularly in relation to data governance, technology resilience, automated controls, and regulatory reporting accuracy. These findings suggest that strong governance structures alone are insufficient without continuous enhancement of technology controls, cyber resilience, and audit assurance to address emerging digital risks. This study contributes to the existing literature by integrating the COSO Internal Control Framework, ERM, the Three Lines Model, Shariah Governance, and GIAS into a proposed Technology Risk Governance Assurance Model (TRGAM) for Islamic Financial Institutions. The proposed model provides practical guidance for strengthening technology governance, improving operational resilience, enhancing regulatory and Shariah compliance, and supporting sustainable governance in the digital banking environment.