An Ontology-Based Modeling Approach for Representing Reusable Internal Control Violation Detection Logic: A Proof of Concept Using Synthetic O2C and P2P Scenarios

Digital transformation has expanded the use of audit analytics to detect internal control violations. However, detection logic is often embedded in system-specific queries and data preparation procedures, limiting reuse across heterogeneous systems. As a result, repeated adaptation is required when the same analysis is applied to different business processes or systems. This study proposes an ontology-based modeling approach that separates reusable rule-based analytical logic from domain-specific Business Semantics, application conditions, and source-specific data reconstruction. The approach uses a three-layer model: L2 for generic Business Semantics and rule-based analytical logic, L1 for domain-specific Business Semantics and application conditions, and L0 for reconstructed business data. The model is implemented using the Resource–Event–Agent ontology, Gal’s internal control axioms, the Ontological Modeling Language, and openCAESAR. The approach is evaluated as a proof of concept using controlled synthetic order-to-cash and procure-to-pay scenarios for candidate segregation-of-duties violations. The results show that the same L2-layer detection rules and SPARQL violation extraction query were reused without modification, while L1 definitions and L0 data reconstruction remained scenario-specific. All predefined positive, negative, and multiple-candidate test cases produced the expected results. The findings are limited to the evaluated synthetic scenarios and do not establish broader generalizability or scalability.