Digital Twin-Enabled Stress Testing of Financial Controls in ERP Environments: A Framework for Systemic Resilience

Abstract

Digital twin technology used in the enterprise resource planning landscape opens a door to validation of financial controls in real time and under extreme dynamic circumstances that cannot be accomplished using customary audit environments. Customary validation of controls is not dynamic and is performed as a snapshot of controls operating in conformance to design specifications. These methods may neglect to consider the combined presence of multiple stressors‚ including market liquidity crises‚ coordinated fraud as a service‚ cascading system failures‚ and dramatic regulatory changes․ The creation of high-fidelity representations of the financial processes, transaction flows, authorization hierarchies and control rules enables the simulation of adversarial and edge cases in a safe environment without risking production systems. It defines the steps to perform data extraction, governance, process and control rule modeling, stress scenarios, privacy-preserving data management, dynamic model validation via backtesting and expert parameter calibration. It also identifies the performance metrics based on resilience, such as fraud detection rates, risk mitigation rates, throughput improvement rates, and compliance assurance rates, which are quantitative measures of control efficacy that utilize simulation outputs. In addition to supporting internal governance processes, these metrics can help satisfy regulatory compliance needs. Hybrid simulation and audit techniques address known limitations of simulation in risk management, such as the high cost of implementation, the decay of models used in such practice, the privacy concerns of regulatory regimes, and resistance from audit and finance functions. As a continuous improvement discipline, the digital twin framework helps organizations proactively identify and improve latent control weaknesses in increasingly complex enterprise risk environments before they can cause operational failure rather than merely detect when operational failure occurs (or is imminent).

DOI: https://doi.org/10.17762/ijisae.v14i1s.8230