Theodore J. Mock

An Information Systems Security Risk Assessment Model Under the Dempster-Shafer Theory of Belief Functions

This study develops an alternative methodology for the risk analysis of information systems security (ISS), an evidential reasoning approach under the Dempster-Shafer theory of belief functions. The approach has the following important dimensions. First, the evidential reasoning approach provides a rigorous, structured manner to incorporate relevant ISS risk factors, related countermeasures, and their interrelationships when estimating ISS risk. Second, the methodology employs the belief function definition of risk--that is, ISS risk is the plausibility of ISS failures. The proposed approach has other appealing features, such as facilitating cost- benefit analyses to help promote efficient ISS risk management. The paper elaborates the theoretical concepts and provides operational guidance for implementing the method. The method is illustrated using a hypothetical example from the perspective of management and a real-world example from the perspective of external assurance providers. Sensitivity analyses are performed to evaluate the impact of important parameters on the models results.

Does Increased Audit Partner Tenure Reduce Audit Quality

The Sarbanes-Oxley Act of 2002 requires the lead audit or coordinating partner and the reviewing partner to rotate off the audit every five years so the engagement can be viewed “with fresh and skeptical eyes.” Using data obtained from actual audits by multiple U.S. offices of three large international audit firms, we examine whether there is a relationship between evidence of reduced audit quality, measured by estimated discretionary accruals, and audit partner tenure with a specific client. We find that estimated discretionary accruals are significantly and negatively associated with the lead audit partners tenure with a specific client. Thus, audit quality appears to increase with increased partner tenure. After controlling for client size and engagement risk, we find audit partner tenure significantly and negatively associated with estimated discretionary accruals only for small clients with partner tenure of greater than seven years, regardless of risk level. We also find that tenure is not significantly associated with estimated discretionary accruals for large clients. This suggests that as partner tenure increases, auditors of small client firms become less willing to accept more aggressive financial statement assertions by managers, and that partner tenure does not affect audit quality for large clients or for shorter-tenure smaller clients. Our results relating to audit partner tenure are consistent with the conclusions about audit firm tenure by Geiger and Raghunandan (2002); Johnson, Khurana, and Reynolds (2002);Myers, Myers, and Omer (2003); and Nagy (2005) and extend their findings by focusing on individual audit partners rather than on audit firms.

Learning Patterns, Decision Approach, and Value of Information

This paper reports on research designed to provide insights into the relationships between different information structures, decision approaches of decision makers and learning patterns. The motivation for the study arose from the work done previously by Mock [16]. This section of this paper summarizes the research findings from [16], and develops a motivation for investigating the additional decision-information variables. Some research findings regarding these variables are then summarized, followed by a discussion of the results of this study.

Belief functions in accounting behavioral research

Behavioral accounting research deals with a complex set of phenomenon including the broad domain of human decision making under uncertainty. Two aspects of decision making of particular relevance to accounting and auditing research are two constructs that are inexorably interrelated: uncertainty and information (evidence). This paper introduces a theoretical perspective that enriches the knowledge-set that may be used in behavioral accounting research when confronting decision contexts that involve uncertainly. The main body of the paper is an introduction to belief functions. The introduction includes a discussion of the fundamental constructs and then illustrates the use of belief functions in two audit settings: traditional financial statement audit planning and the evaluation of evidence in a cascaded-inference setting involving the ebaluation of internal accounting control. The paper concludes with a brief exploration of some of the research issues and opportunities that are related to the potential use of belief functions in behavioral accounting research.

An evidential reasoning approach to Sarbanes-Oxley mandated internal control risk assessment

In response to the enactment of the Sarbanes-Oxley Act 2002 and of the release of the Public Company Accounting Oversight Board (PCAOB) Auditing Standard No. 5, this study develops a risk-based evidential reasoning approach for assessing the effectiveness of internal controls over financial reporting (ICoFR). This approach provides a structured methodology for assessing the effectiveness of ICoFR by considering relevant factors and their interrelationships. The Dempster-Shafer theory of belief functions is utilized for representing risk.

A comparison of Norwegian and United States accounting students' learning style preferences

Individual differences among humans are apparent in many environments and situations. Educators should be concerned about whether such differences are systematic to such an extent that they significantly affect the effectiveness of various pedagogical methods and training approaches. This paper investigates one type of individual difference-learning style-which may vary across cultures and which may be relevant for both accounting education and audit practice. Learning style is defined as an individual orientation to learning, utilizing four basic modes of learning to various degrees. Learning style measures were obtained from Norwegian and United States accounting students with varying experience levels. The learning styles for the US students were compared to data obtained in prior research and were found to be generally consistent with these studies. The Norwegian sample was compared to both the current United States results and prior research and was found to be significantly different from the US lea...

Audit risk and audit programmes: archival evidence from four Dutch audit firms

The audit risk model has become an extremely important element in audit practice. The basic intuition behind the model is that changes in risk should affect the work of the auditor. However, little systematic empirical evidence has been published on the assessment of audit risk and its effect on audit work. This study, using documentation from actual audits and follow-up interviews, provides such evidence. Assessments of audit risk and audit programme details have been obtained from eight clients of four Dutch audit firms. Audit risk assessments are obtained for two risk categories: (1) audit risk factors, such as the degree of client management turnover or the quality of the clients internal audit department; and (2) audit risk model variables (inherent or control risk), related to the account or assertion being audited. The results indicate that there is substantial variation in audit risk factors between clients and among the audit risk factors per client. To a lesser extent these findings hold for the risk model variables. The study also indicates that to some degree there is risk variation over time. Variability of risk factor assess-ments over time is higher than variability of risk model variable assessments over time. Audit programmes differ substantially between clients and, to a lesser extent, over time. Interestingly, the only two engagements with a change in the audit programme were the clients with most risk factor changes. The study also identifies factors other than risk, such as a change in the audit team, that influence audit programme planning. The observation in Dutch audit practice of variation in both risk assessments and audit programmes highlights the opportunity to design risk-adjusted audits, which are both efficient and effective. In addition, this observation encourages the carrying out of further research to fine-tune our models concerning which factors are most important within the audit risk model and to the audit planning process.

Verbal protocol research in auditing

Abstract Recognizing the increasing interest in verbal protocol analysis in auditing research, this paper reviews the literature in this area. Consideration is given to the research problems investigated, the underlying theories appealed to, the methodological issues addressed and the overall contribution made by each of seven studies. Future directions for audit research using protocol techniques are then discussed prior to a concluding assessment of research in the area.

Information support systems for problem solving

Abstract The occurrence in the literature of success stories dealing with (management) information systems is rare indeed. This paper addresses some of the possible factors that make it difficult to design and implement successful information (and decision support) systems. More specifically, we consider the role of problem formulation and specification, including goal setting, in the design of information systems.

A Synthesis of the Information Economics and Lens Models

Research in accounting has developed in a number of distinct paths within the past decade. Human knowledge concerning the understanding of complex phenomena is often acquired through a succession of increasingly complex models. One strategy which may increase understanding of accounting phenomena is to integrate and synthesize two or more accounting research areas. Synthesis may be valuable per se or may be performed due to dissatisfaction with the specifics of each examined research approach. This note presents a synthesis of research in information economics and human information processing (specifically the lens model approach in the latter). First, the criteria that a proposed model should satisfy are defined. Then, the essential elements of the lens and information economics (I/ E) models are introduced and some limitations and difficulties are identified. This is followed by an integration of the essentials of both underlying models. The final section contains both an evaluation of the synthesized model in terms of the earlier established criteria and some future research questions. The critical analysis of a model often leads to questions regarding the cost-benefit aspects of the proposed model over competing ones. For example, a more complete model may be more complex, which may render it difficult to put into operation. Unfortunately, the evaluation of the cost-benefit aspects of a model is not an easy task, given the lack of well-defined criteria.