KNOWLEDGE-BASED INTERNAL CONTROL EVALUATION AND QUALITATIVE MODELLING

Abstract

Internal control evaluation is a phase within an audit wherein an auditor assesses the design of an accounting system for potential strengths and weaknesses from the standpoint of internal controls. The aim of such an evaluation is partly to justify partial substitution of some audit tests, which are labor intensive and time consuming, with evidence of reliability of the accounting system being audited. More than just an exercise in reducing audit testing, internal control evaluation is also an important quality-assurance measure. This is because audit tests, which are after-the-fact verifications, cannot give the same assurance that can be obtained from the exercise of proper controls when the transactions occurred. The problem of internal control evaluation is an important one to the auditing profession. Its importance has recently been highlighted by the superceding of SAS no. 1 AU section 320 by SAS no. 55. In SAS 55, the requirements for auditors to gain thorough understanding and provide documentation of the internal control structure of the audited entities has been made more demanding. The scope of such activities has also been broadened beyond accounting controls and administrative controls to include all policies and procedures that are relevant to an audit. Knowledge-representation for internal control evaluation is viewed here as a two-part problem: the representation of the knowledge of the accounting system being evaluated, and the representation of the knowledge of how to carry out such an evaluation. This thesis describes two knowledge representations as solutions to this problem: the Process-Flow Representation (PFR) and the Control Specification Language (CSL). The PFR, a modelling paradigm based on data-flow diagramming, is used to represent the first type of knowledge. The CSL, an embedded language in Prolog, is used in expressing the second type of knowledge. This approach to the problem is different from other work on expert systems in internal control evaluation because it is a synthesis of the usual rule-based, empirical-knowledge approach and the approach of inferring faults from models of the entities being diagnosed. In the first part of the knowledge representation problem, the approach taken was to capture as much information as possible from diagrams of the accounting systems being evaluated. A computer-based tool was created to capture such diagrammatic information and to translate it into a PFR model. During internal control evaluation, this model is queried for the existence of certain procedures, documents, relations between procedures, etc. While PFR models can be generated automatically from diagrams of accounting systems, the second type of knowledge must be manually encoded. Therefore a major requirement for the second knowledge-representation was that it had to represent knowledge in a form that was as familiar to auditors as possible. The knowledge thus represented can be maintained by auditors - most of whom are non-programmers. The simple query language created for this purpose is called the Control Specification Language (CSL). A prototype was built to test out these knowledge-representation concepts. This prototype was tested using two case-studies; from these tests, it has been found that the PFR is a simple and perspicuous way of qualitatively modelling accounting systems for internal control evaluation. The CSL has been found to make the representation of internal control evaluation knowledge more explicit than would be possible using an off-the-shelf expert system shell. These case studies show that the prototype is able to produce valid recommendations in internal control evaluation. A diagrammatic input facility for creating PFR models was built using Actor™, an object-oriented programming language. The knowledge-representation and the modules that performed internal control evaluation were built using Arity Prolog™. The prototype was completed in about 12 man-months.