REDUCING RISK IN THE ENTERPRISE

Proposal for a Hybrid Audit Expert System

Susan Clemmons, Kenneth Henry

Decision Sysetms and Information Systems Department

Florida International University, Miami, Florida

, USA

Keywords: Expert System; Fuzzy Logic; Audit;

Abstract: This paper theorizes the use of a hybrid expert system to support

a complete audit of financial statements for

an enterprise. The expert system proposed would support the audit process by using two types of artificial

intelligence technologies: case-based reasoning and fuzzy logic technologies. The case base and automated

reasoning recommendations would give the auditing firm another insight on the audit. Unlike previous audit

expert systems, this system is intended to focus broadly on an enterprise’s entire financial statement audit

process; it combines a case based knowledge representation with fuzzy logic processing. The attempt at

capturing a wide domain is necessary to support organizational decision-making. Focusing on narrow

decision points within an audit process limits the users and usefulness of the system.

1 INTRODUCTION

Accounting firms and researchers have devoted

significant effort to the use of decision support

applications to assist in audit work. Many of these

systems have been developed combining the

knowledge and rules of the practice in the form of

knowledge based expert systems. The use of expert

systems as decision support tools in narrow auditing

specialty areas is well documented (O'Leary, 1993).

However, a conceptual gap remains when the

outcome of several audit decisions are combined for

an overall opinion or outcome decision. It has been

noted that business expert systems lack a strategic

focus for organizational decision-making support

(Wong and Monaco 1995).

This paper theorizes the use of a hybrid

pert system to support a complete audit of

financial statements for an organization. The

financial statement audit consists of more than one

hundred action steps, and reviews four specific

financial documents. It is conducted through a

process that is triggered by many different decisions.

Some of the decisions can be supported through tax

codes and audit rules of generally accepted auditing

standards (GAAS). Other decisions rely on the

auditing firm’s knowledge of the client company,

the industry practices, and the firm’s prior

experiences, to assist in determining the proper

course of action. The audit of financial statements is

a complex series of judgments that leads to an

opinion about the financial health of organizations.

The audit is a critical financial information

validation process for all organizations.

As the use of expert systems started to

row, Bailey et al (Bailey, Hackenbrack et al, 1987)

outlined an expert system research agenda in the

accounting and audit area. They stress that the

contribution of academia is not one of software

development and creation, but one of thought

leadership about the decision making process used in

auditing. They advocate this direction as the

fundamental research objective of the academic

community. In this paper, we try to follow this

agenda and offer a method suited for the audit

environment to support the decision making process

of the auditing firm.

The expert system proposed would support

e audit process by using two types of artificial

intelligence technologies: case-based reasoning and

fuzzy logic technologies. The case base and

automated reasoning recommendations would give

the auditing firm another insight on the audit.

Typically, the domain of expert system applications

is very narrow. This allows for complete

exploration and rule development to support the area

of expertise (Giarratano and Riley, 1998). The

domain suggested for this hybrid system is much

260

Clemmons S. and Henry K. (2005).

REDUCING RISK IN THE ENTERPRISE - Proposal for a Hybrid Audit Expert System.

In Proceedings of the Seventh International Conference on Enterprise Information Systems, pages 260-266

DOI: 10.5220/0002540702600266

 SciTePress

more general, and broader in scope, as it would

encompass the entire financial statement audit

process. The use of fuzzy logic or reasoning would

allow the representation of uncertainty or a degree of

certainty in the case data. Some of the decisions

used in the audit process are not simply “either or”

situations but use some gradation of the answer.

The use of fuzzy variables would assist in the

representation of this type of data (Fetter and

McMillan, 1987). This approach focuses on

organizational decision-making with the

combination of technologies, the wide decision

support domain, and makes this design unique.

The body of this paper is organized into

three sections. The first section gives a brief

explanation of expert systems use in business and

auditing. It highlights important elements that must

be considered when building an auditing expert

system. The second section describes the details of

the planning audit step as a case for processing in an

expert system. It uses pseudo code examples and

reasoning logic to describe the case structure and

definition. The last section gives a brief discussion

of the validation options for this approach.

2 AUDIT CONCEPTS

Expert systems are classified different ways. A

system may be classified by the way a problem is

addressed, the problem or expert domain, or by the

intended user group of the system. Generic problem

classifications can be overlapping due to many

expert systems containing more than one method of

problem resolution. The audit domain expert system

proposed in this paper combines problem

interpretation and prediction.

There are three commonly cited types of

expert systems: rule-based, model-based, and case

based. A fourth category, hybrid systems, has been

used recently that describes systems that overlap

these definitions. Hybrid systems combine different

types of technology, and may have several

knowledge presentation and inference modes. Most

of the business applications developed during the

1980s and 1990s were rule-based expert systems.

These systems represent knowledge in the form of a

rule stated by an IF-THEN format. When a certain

event occurs or relationship is present, then the

certain outcome is likely; and this outcome points to

appropriate actions. The application of sequential

rules leading to the most likely conclusion is

referred to as chaining (Turban, 1992). The chain is

formed as the action or result of a rule is linked to

the condition of the next rule or relationship.

Inference engines with a rule-based design have two

ways to proceed to an outcome. Backward-chaining

inference engines start with a goal and the search for

rules that will establish the facts to support the

conclusion. Forward-chaining inference engines are

data driven searches that arrive at a conclusion based

on the data presented. Typically, the auditing expert

system will fall into this category.

There are several advantages to using rule

representation to recommend a course of action.

Rules are easy to understand. They are a natural

form of knowledge and can be found in everyday

life. Inferences and explanations are also easily

derived from rules. Rules make modifications and

maintenance of the system simple. However, rules

also have limitations when used to represent

knowledge (Hayes-Roth, Waterman et al. 1983).

Complex knowledge may require thousands of rules,

as is the case with audit experience and judgment;

this could create a problem in the system

maintenance issue. Due to the common use of rules,

builders of expert systems tend to rely on this

knowledge representation, when other methods may

be more appropriate (Turban, 1988).

Model-based expert systems are based on

knowledge that represents the structure and behavior

of devices that the system is designed to understand.

They are useful in diagnosing equipment problems.

The system draws conclusions directly from

knowledge of the structure and behavior. One

feature of model-based expert systems is their

"transportability". A rule-based expert system may

be of no value for repairing a different type of

device that does not match its rules. A model-based

system could be used to diagnose or repair the

problem of any type of device based on the model

(Turban, 1992).

Case based expert systems use case based

reasoning to adapt solutions that were used to solve

old problems and use them for the basis of a new

solution for a new problem. Case based reasoning is

a problem solving approach based on the retrieval

and adoption of episodes with descriptions of

problems and their associated solutions. One

advantage of using case based reasoning is that the

existing data and knowledge is leveraged and can be

included in the database. The knowledge does not

have to be translated and coded into rules. This

makes knowledge acquisition a much faster process

(Kesh, 1995), critical for the audit domain expert

system. The system learns from both successes and

failures of cases. The more interaction or learning

that takes place, the richer the case database. Case

base reasoning systems provide information for

questions. Explanations then can be provided by

REDUCING RISK IN THE ENTERPRISE: Proposal for a Hybrid Audit Expert System

261

rule-based systems. A rule-based system provides

the explanation by the rules used to create the

solution. In a case based system, actual cases that

come close to matching the input case are used to

describe the solutions. Case based reasoning mimics

the human cognitive process for problem solving

better than other types of expert systems. Recall

usually takes the form of remembering the entire

case or episode rather than a set of rules. In this

way, case based expert systems are seen as more

flexible and friendly to system users (Kesh, 1995).

Hybrid systems are systems that use a

combination of knowledge base and reasoning

engines to derive a solution. They use the strengths

of each of the solutions to produce a result superior

to those of just a single method. Soft computing

techniques are being applied where uncertainty and

learning a part of the systems requirement. Soft

computing refers to techniques such as fuzzy logic,

neural networks, and genetic algorithms. Examples

of hybrid systems are expert systems utilizing

production rules in the knowledge base and fuzzy

logic as part of the inference engine. Nolan (Nolan,

1998) found that fuzzy technology enables the

improvement of approximate reasoning by three

different methods: (1) through efficient numerical

representation of vague terms, (2) through increased

range of operations in ill-defined environments, and

(3) by decreasing sensitivity to noisy data.

Some research (Lenard, Alam et al. 2001)

suggests the use of fuzzy clustering applied to

qualitative questions asked during the audit can be

successfully used in a hybrid system. Their work

focused on combining fuzzy clustering and a proven

statistical model to support an auditor’s decision

about going concern. Their expert system hybrid

model provides statistical support and expert

knowledge for use in the audit opinion. The success

of their system with bankruptcy predictions indicates

using both quantitative and qualitative information

has the potential for better accuracy than each model

being used separately. Strategic expert systems is

still an under addressed topic in business (Wong and

Monaco, 1995). This type of expertise is difficult to

extract, and due to wide domain areas, the issues

may be very complex and interrelated. While

researchers have recognized the importance of these

systems, there is a void in the business literature

with regard to this topic.

3 BUILDING PROCESS

The domain of auditing is defined as: "a systematic

process of objectively obtaining and evaluating

evidence regarding assertions about economic

actions and events to ascertain the degree of

correspondence between those assertions and

established criteria and communicating their results

to interested users" (Concepts, 1973). There are

three types of audits: (1) financial statements audit,

(2) compliance audits, and (3) operational audits.

The financial statements audit encompasses the

process of collection and evaluation of evidence

about an organization's financial statements. Its goal

is to express an opinion as to the statements’ fair

representation of the financial position, results of

operations, and cash flows of the organization; and

whether they are prepared in conformity with

Generally Accepted Accounting Principles (GAAP)

and other applicable criteria.

Briefly described, the financial statement

audit process consists of four phases: (1) Planning

and design of the audit approach, (2) performing

tests of controls (TOC) and substantive tests of

transactions (STOT) (3) Performing analytical

procedures and tests of detail balances (TDB),

(4) Completing audit fieldwork and issuing the audit

report. This formal structure lends itself easily to

the application of a case-based approach. Each set

of case data generated by the performance of the

annual audit for a given client is conveniently stored

in a matrix format, wherein a specific set of tasks

must be performed in a specific order. This is done

overall for audit planning purposes, and more

specifically for each “audit cycle” performed for the

financial statement line item classification.

Each audit performed by the audit firm will

generate data and expert system recommendations in

each of the four phases for a wide variety of

circumstances. The collection of facts, rules,

inferences, and conclusions will be represented by

one case in the expert system’s case database. Every

successful audit firm will normally perform multiple

audits during the course of a year, with each audit

generating a new case for the database.

Furthermore, as the years pass, additional cases are

generated for new conditions as a given audit

client’s financial statements undergo the annual

auditing process.

Within each cell of the defined case matrix,

a specific set of data (facts) must be gathered about

the planning for that phase or about the financial

statement line item for the other phases. Also for

each cell, a specific set of rules (production rules)

must be applied to the facts (asserted or bound). The

inference engine of the expert system must then

apply the rules to the facts gathered, typically using

fuzzy logic algorithms, and generate

ICEIS 2005 - ARTIFICIAL INTELLIGENCE AND DECISION SUPPORT SYSTEMS

262

recommendations for specific audit conclusions

derived, and procedures to be performed.

For illustration purposes, the next section of

the paper gives a detailed description of the facts to

be gathered (audit evidence) and the rules to be

applied (generally accepted auditing standards) in

phase I of the plan and design of an audit: making

the audit decision on acceptance/renewal of a client.

Selected sets of facts and rules are shown using

CLIPS-like pseudo-code to demonstrate how the

facts are asserted or bound, and how the rules are

applied to produce expert audit conclusions.

3.1 Accepting or Rejecting a Client

The expert system, being used as an audit firm’s

assistant, has four decisions to make at this early

stage of the audit. First, the audit firm must decide

to accept (or not) a new client or continue (or not)

serving an existing one. An individual auditor will

review and recommend the course of action to the

audit firm’s management. Typically, the

recommending auditor is experienced and in a

position to make important decisions. This decision

needs to be made early, before the audit firm incurs

any significant audit costs that cannot be recovered.

Therefore, the more information about this type of

decision in the case database, the better decision the

expert system can make. Second, the audit firm

identifies why the client needs or wants the audit.

This information is likely to affect the remaining

parts of the planning process, because it directly

affects the audit scope. Third, the audit firm obtains

an understanding with the client about the terms of

the engagement to avoid any misunderstandings.

Fourthly, the audit firm must select staff for the

engagement, including any required audit specialists.

Stated in terms of audit risks, an audit

expert is unlikely to accept a new client or continue

serving an existing client if acceptable audit risk

(AAR) is higher than the CPA firm’s risk threshold.

This suggests the first of the facts to be asserted and

rules to be defined by the audit expert system

(assert AAR-threshold)

…

(bind ?AAR-value

…

(defrule accept-or-reject1

(> ?AAR-value AAR-threshold)

(assert (reject-client)))

3.2 New Client Investigation

An audit firm should evaluate a prospective client’s

standing and reputation in the business community,

its financial stability, and the relations with its

previous CPA firm. For example, many audit firms

are very cautious in accepting new clients in newly

formed, rapidly growing businesses. From

experience, many of these businesses fail

financially, and expose the audit firm to significant

potential liability. For prospective clients previously

audited by another CPA firm, the new successor

audit firm is required by SAS 84 (AU §315)

“to

communicate with the predecessor audit firm”, to

help the successor audit firm evaluate whether to

accept the engagement. Communications may

inform the successor audit firm that the client lacks

integrity, or that there have been disputes over

accounting principles, audit procedures, or fees.

Even when another CPA firm has audited a

prospective client, other investigations are often

made. Sources of information include local

attorneys, other CPA firms, banks, major suppliers

and customers, and other resources. In some cases,

the audit firm may hire a professional investigator to

obtain information about the reputation and

background of key members of management. A

more extensive investigation may be necessary when

there is no previous audit firm, when a predecessor

audit firm will not provide the requested

information, or when any problems arise from the

communication. In expert systems terminology:

(bind (?client-integrity “high”))

(bind (?disputes “none”))

…

(defrule accept-or-reject2

(client-integrity = “high”) AND

(disputes “none”)

(assert (accept-client)))

The series of audit judgments made is illustrated in

this section using pseudo-code. This is intended

merely to convey the facts to be considered and

rules to be applied, and is not intended to represent

portions of a syntactically correct CLIPS program.

AICPA Codification of Statements on Auditing

Standards AU §315.01 to §315.23

REDUCING RISK IN THE ENTERPRISE: Proposal for a Hybrid Audit Expert System

263

3.3 Continuing Clients

Many audit firms evaluate existing clients annually

to determine whether there are reasons for not

continuing to do the audit. Previous conflicts over

such things as the appropriate scope of the audit, the

type of opinion to use, or professional audit fees,

may cause the audit firm to discontinue association.

The audit firm may also determine if the client lacks

integrity and therefore should no longer be a client.

If the client files a lawsuit against an audit firm or

vice versa, the firm cannot do the audit. Similarly, if

there are unpaid fees for services performed more

than one year previously, the CPA firm cannot do

the audit. To do an audit in either of these

circumstances violates the AICPA’s Professional

Conduct Rules on independence.

Even if none of the previously discussed

conditions exists, the audit firm may decide not to

continue doing audits for a client because of

excessive risk. Just as for new clients, excessive risk

for a continuing client is when acceptable audit risk

(AAR) is above the audit firm’s threshold. For

example, a CPA firm might decide that the client’s

tax position vis-à-vis changing IRS regulations gives

rise to considerable risk of regulatory conflict

between the IRS and the client, which could result in

financial failure of the client, and ultimately lawsuits

against the CPA firm. Even for a profitable

engagement, the risk may exceed the short-term

benefits of doing the audit.

Investigation of new clients and re-

evaluation of existing ones is an essential part of

deciding acceptable audit risk. Assume a potential

client in a reasonably risky industry, where

management has a reputation of integrity, but is also

known to take aggressive financial risks. If the CPA

firm decides that acceptable audit risk is extremely

high, it may choose not to accept the engagement. If

the CPA firm concludes that acceptable audit risk is

high but the client is still acceptable, that is likely to

affect the fee proposed to the client. Audits with a

high acceptable audit risk would normally result in

higher audit costs that will be reflected in higher

audit fees.

(assert (AAR-value “low” ))

…

(assert IRS-regulation)

(assert tax-position)

(bind ?industry “risky” )

(bind ?client-integrity “high”)

(bind ?management-aggressive

“high”)

…

(defrule accept-or-reject3

(<> tax-position

IRS-regulation)

(assert (AAR-value “very

high”))

…

(defrule accept-or-reject4

(= ?industry “risky” ) ( =

?client-integrity “high” )

(= ?management-aggressive

“high”)

(assert (AAR-value “high”)))

…

(defrule accept-or-reject5

(= ?AAR-value “low”)

(assert (accept-client)))

…

(defrule accept-or-reject6

(= ?AAR-value “high”) )

(assert (accept-client))

(assert (increase-fee)))

…

(defrule accept-or-reject7

(= ?AAR-value “very-high”)

(assert (reject-client)))

4 VALIDATION OF THE SYSTEM

One of the most important steps in expert system

development is the validation of the decision model

and domain boundaries. Typically, validation

entails comparing outcome measures between the

computer model and that of the experts used during

the knowledge acquisition process. If differences

are found, developers must fine-tune the model to

reflect accurate representation of the expert’s

knowledge. The next step in the process adds

additional expert opinion to address the same

questions and outcomes. Outcomes are compared

and if any significant variations are found between

the original expert opinion and the secondary

experts, information is sought to explain the

differences. The validation process occurs through

two methods. The first method is using a statistical

approach to analyze judgment outcomes. The

second approach is tracing the process for

understanding the sequence and relationships.

Process tracing is used to capture the outcome of a

judgment leading to the outcome used in the

problem domain. Each of these methods generally

explains significant levels of variation and yield

ICEIS 2005 - ARTIFICIAL INTELLIGENCE AND DECISION SUPPORT SYSTEMS

264

interesting results. However, the methods do not

provide satisfactory explanations for the observed

differences. Understanding the domain judgment

requires more than knowledge. To generate possible

hypotheses, to recognize potential relationships, and

to create strategies for using the knowledge, a

greater understanding of the domain is necessary.

Four integral steps are used in the proposed

Expert System Research Approach (ESRA):

knowledge acquisition, knowledge representation,

computational modeling, and theory validation. In

the first two stages, the researcher identifies and

organizes the many processes that constitute the

domain expertise. The modeling stage then takes

this expertise and translates it into a computer

compatible representational framework. Once

confidence is achieved in the computer model

adequately emulating the experts’ process, the

theory validation phase has begun. The computer

model is seen as a validation of the researchers

understanding of the emulated domain. Any

additional efforts to extend this degree of confidence

can only improve the representation of the experts’

judgment. This approach does not rely on a single

expert's opinion. It uses many sources of expert

domain knowledge to create the system. The breath

of the domain is critical to the depth of

understanding achievable in the system [2].

Typically, the broader the domain the more shallow

representation of understanding the judgment

process is achieved. However, if the domain has a

well-established process and high degree of

governance, the domain may be more accurately

represented. Having a well-defined domain

establishes much of the necessary knowledge for the

experts to use in their judgment making. The expert

system described in this paper uses the well

established auditing process and auditing

governance to represent the domain.

Instead of focusing on a single decision that

an expert's judgment is critical for successful

outcome, the auditing expert system focuses on the

entire domain and guides the user to a logical result

based on the past audit decisions. Using a case

based system the validation of the correct outcome is

found in prior decisions made with similar domain

parameters. If the theory validation process suggests

agreement between the computer case model and the

test cases, a researcher can be reasonably assured

that the domain and judgment tasks have been

represented correctly.

5 CONCLUSION

This paper has set forth a design for an expert

system in the audit domain. Unlike previous audit

expert systems, this system is intended to focus

broadly on the entire financial statement audit

process and combines a case based knowledge

representation with fuzzy logic processing. The

attempt at capturing a wide domain is necessary to

support organizational decision-making. Focusing

on narrow decision points within an audit process

limits the users and usefulness of the system.

Narrow domain systems typically support only

individual decision-making. By widening the

domain, the judgment process is also widened. This

holistic approach to organizational decision-making

strives to support the audit process and the audit

organization. In addition, the case based model

allows the system to store results of multiple experts

with the firm so that as the case base grows and

knowledge increases, the quality of the decisions

made by the system will improve. This heuristic

component of the proposed expert system is yet

another significant improvement over previous audit

expert system designs.

A number of factors remain unaddressed in

this approach. The complexity and size of the expert

audit system may make it too difficult and

cumbersome to process outcomes in a useful timely

manner. Development of the actual system would

be necessary to understand the limitations of

computing power and processing for this wide of a

domain. After development, empirical testing will

need to be employed to validate the approach and

attempt to duplicate the domain. The audit domain

needs to confirm the usefulness of this type of

system. Reality of the interaction complexity of the

process steps needs to be accounted for in the

design. Most expert system use a hierarchical

decision making process. Being organizational

driven, the decision making approach needs to be

more matrix in nature.

The value of using this audit system will be

represented in many ways. The first way is the

support and assists individual auditors gain from

using the system. It may assist them in feeling more

confident about their decisions and create new

environments to learn the audit process within

without having to be in a real-world situation.

Another contribution may be in the reduction of

professional errors in judgment with regard to audit

conclusion. This is a well-documented phenomenon

and the negative results have resulted in resent

industry and government corrective action. The last

and foremost contribution of the use of this system

REDUCING RISK IN THE ENTERPRISE: Proposal for a Hybrid Audit Expert System

265

may be in organizations making better and more

effective decisions using the captured knowledge of

experts over time. Such a system that can support

organizational decision making by approximating

process and judgment of a human expert would be a

valuable contribution to real-world application areas.

Although this system will never replace the actual

audit firm, it may increase its ability to better service

clients and the industry, and improve on the

judgment capabilities in the audit process.

REFERENCES

Bailey, A. D., K. Hackenbrack, et al. (1987). "Artificial

Intelligence, Cognitive Science and Computational

Modeling in Auditing Research: A Research

Approach." Journal of Information Systems (Spring):

20-40.

Concepts, C. o. B. A. (1973). A Statement of Basic

Auditing Concepts. Sarasota, FL, American

Accounting Association.

Fetter, R. B. and C. McMillan (1987). Business Expert

Systems. Homewood, Illinois, Irwin.

Giarratano, J. and G. Riley (1998). Expert Systems

Principles and Programming. Boston, PWS

Publishing Company.

Hayes-Roth, F., D. A. Waterman, et al. (1983). Building

Expert Systems. Reading Mass, Addision-Wesley

Publishing Company.

Kesh, S. (1995). "Case Based Reasoning." Journal of

Systems Management: 14-19.

Lenard, M. J., P. Alam, et al. (2001). "Decision-Making

Capabilities of a Hybrid System Applied to the

Auditor's Going Concern Assessment." International

Journal of Intelligent Systems in Accounting,

Finance, and Management 10: 1-24.

Nolan, J. R. (1998). "An expert fuzzy classification

system for supporting the grading of student writing

samples." Expert Systems with Applications 15: 59-

68.

Turban, E. (1988). Decision Support and Expert Systems.

New York, Macmillan Publishing Company.

Turban, E. (1992). Expert Systems and Applied Artificial

Intelligence. New York, New York, Macmillan

Publishing Company.

Wong, B. K. and J. A. Monaco (1995). "Expert System

Applications in business: A review and analysis of

the literature (1977-1993)." Information and

Management 29: 141-152.

ICEIS 2005 - ARTIFICIAL INTELLIGENCE AND DECISION SUPPORT SYSTEMS

266