Division of Research Graduate School of Business Administration The University of Michigan A BAYESIAN APPROACH TO'THE AUDIT PROCESS Working Paper No. 325 by Richard W. Andrews The University of Michigan and T. M. F. Smith University of Southampton December 1982 FOR DISCUSSION PURPOSES ONLY None of this material is to be quoted or reproduced without the express permission of the Division of Research. *The first author gratefully acknowledges the financial support of the Ernst and Whinney Foundation.

I ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~~ ~~ ~~ ~~ ~ ~~ ~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~' I ~~ ~ ~~ ~ ~~ ~ ~~ ~ ~~ ~ ~~ ~ ~~ ~ ~~ ~ ~~ ~~~ ~~~ ~~~ ~~~ ~~~ ~~~ ~~~ ~~~ ~~ ~~~ ~~ ~~~ ~~ ~~ ~~ ~~ ~~~~~~~~

A BAYESIAN APPROACH TO THE AUDIT PROCESS Abstract A problem in auditing is to combine qualitative evidence based on observing the accounting system with quantitative evidence based on the results of checking specific items for compliance and for subsequent recorded numerical accuracy. This paper describes a Bayesian approach to this problem that models and links the four sources of audit evidence: system evaluation, compliance testing, substantive tests of details, and analytical review. The model is developed for application to a single financial statement classification and assumes low error rate populations. Calculated specific examples indicate the responsiveness of the model to changes in prior settings and sample observat ions. KEY WORDS: Auditing; Bayesian model; Compliance test; Posterior distribution; Substantive test.

~~I ~ ~ ~ ~ ~ ~ I

1. INTRODUCTION In an ordinary external audit of a corporation an independent certified public accounting firm examines the corporation's financial statements. The examination provides information on the records and activities of the corporation which allow the external auditor to express an opinion about the fairness of the financial statements. Financial statements are made up of various components. For example, the asset side of a balance sheet is a listing of the amount of cash, accounts receivable, inventory, and other components. We term each of these components a financial statement classification. In turn, any single financial statement classification is an aggregate of individual accounts or line items. For example, the accounts receivable classification is the sum of the amount owed by all active customers to the corporation being audited. The objective of this report is to present and analyze a Bayesian model for the process of auditing such a financial statement classification. If the auditor determines that the corporation's financial records are fairly stated, and there are no unusual activities that might jeopardize this situation, the auditor gives an unqualified opinion. There are other cases, of course, in which the auditor gives a qualified opinion. One possible reason for this is that one of the financial statement classifications has been found to be in error by more than what is considered a material amount. It follows that an unqualified opinion implies that none of the financial statement classifications is thought to have a material error. We therefore restrict our attention to the auditor's decision to render an unqualified or qualified opinion about the recorded amount in a single financial statement class if icat ion. -1 -

-2 - In the next section we describe a sequence of procedures used by auditors to accumulate information concerning a financial statement classification. These audit procedures are defined so that they can be modelled in a Bayesian framework. We refer to this sequence of audit procedures as the audit process. At the end of the second section we discuss briefly other Bayesian approaches to the audit process that have appeared in the literature. In section 3 a general Bayesian model for the audit process is presented. The symbols are defined, the assumptions are stated, and the general relationships of the model are given. The total monetary error of the financial statement classification being audited is defined as a function of (i) the error rate of the individual line items and (ii) the error amount as a percentage of the recorded amount, termed the fractional error. Section 4 provides analyses of the component parts of the general model. These analyses are within the Bayesian model and are based on the information collected via the audit process. This Bayesian model and analysis give a comprehensive description of the audit process by incorporating the various sources of information available to an auditor. By using the model as a framework the auditor can structure the process by which an opinion is formed and coherently revised, on the basis of information gathered via the audit process. In the concluding section we illustrate these consequences by giving two examples of the use of this model. 2. THE AUDIT PROCESS The second and third standards of fieldwork for auditing (Codification of Statements on Auditing Standards [1982]) state the following: (1) There is to be a proper study and evaluation of the existing internal control as a basis for reliance thereon and for the determination of the resultant extent of the tests to which auditing procedures are to be restricted.

-3 - (2) Sufficient competent evidential matter is to be obtained through inspection, observation, inquiries, and confirmations to afford a reasonable basis for an opinion regarding the financial statement under examination. These two standards require that the external auditor employ some procedures to gather information or evidence on which to base an opinion. The second standard of fieldwork refers to the system of internal control which generates the financial quantities and provides checks on the accuracy with which these numbers are generated. The third standard of fieldwork requires that sufficient competent evidential matter be collected. This is usually interpreted to mean that some of the monetary values that comprise the financial statement classification total must be audited. However, these standards do not specify what procedures should be used. Various accounting firms and other researchers have specified audit processes that conform to these standards. Loebbecke (1981) gives a general outline of an audit process consisting of three phases (planning phase, system testing phase, and financial statement phase), and lists the audit activities in each phase. The audit process we employ is more specific and was developed in a manner that makes it compatible with Bayesian modelling. The audit process is applicable to a single financial statement classification and emphasizes the use of sampling. However, this process and the resulting Bayesian model also accommodate nonsampling information and provide linkage between the various forms of information collected. Evidence or information extracted from the audit process can be classified according to whether it impacts the system of internal control or the balance of the financial statement classification. The evidence is considered direct if it is either (i) a compliance attribute observed in testing the control

-4 - system or (ii) a monetary amount observed in the substantive test of balances. Otherwise the evidence is considered indirect. Each of the four procedures that comprise our audit process will be classified with respect to whether the evidence it provides is direct or indirect and whether it relates to the system or balances. The four audit procedures that comprise the audit process are: 1) system evaluation, 2) compliance testing, 3) substantive test of details, and 4) analytical review. System evaluation consists of the observation of the internal control system, the inquiry about the control system, and the auditor's resulting subjective judgment as to the effectiveness of the internal control system in preventing or detecting material errors. As such, the type of evidence it provides is indirect with respect to both the system and the balance. Compliance testing is concerned with the application of the internal control procedures. It consists of specifying key control procedures and then sampling individual items to see if the control procedures were properly applied. The results of compliance testing give direct information about the system but indirect information about the details of the monetary balance. The third audit procedure we consider is the substantive test of details. This test consists of sampling the line items in a financial classification for the purpose of noting whether or not the recorded monetary amount is in error and, if so, by how much. Therefore, the results of this test provide direct information about the details of the monetary balance. The last audit procedure we consider is analytical review. Analytical review consists of comparing financial statement balances with other sources

-5 - of financial data. The other sources may be prior periods, budgeted amounts, or industry statistics. These comparisons are incorporated into the audit process for the purpose of providing information about the reasonableness of the recorded balance. As such, analytical review provides indirect information about the balances These four audit procedures comprise our description of the audit process. In the next section we present a general Bayesian model that incorporates these procedures into the formation of an audit opinion. Previous reports in the literature have applied Bayesian decision theory to some or all of the steps of the audit process. For example, Kinney (1975a) presents a Bayesian model for the substantive test of details based on a hypothesis-testing structure. The model assumes that the test statistic is normal and combines a cost function for sampling with constant losses due to conclusion errors in the hypothesis test. The objective is to specify the sample size needed for the substantive test of details and to state the conclusion on the basis of the sampled data. Kinney concludes that "the decisiontheory approach provides a more complete consideration of relevant factors in the auditor's sampling problem than do other dollar-value sampling approaches." In a follow-up paper Kinney (1975b) provides a decision theory model which integrates system evaluation, compliance testing, and substantive test of details. Therefore, the goals of his work and the work reported in this paper are similar, but the component models and method of final conclusion are different. Again, Kinney uses a hypothesis-testing structure for the final conclusion concerning fair statement. The output from the compliance test phase is a two-point distribution over the two hypotheses. The compliance test is modeled using the binomial distribution for the number of observed errors. The combination of systems evaluation and compliance testing is discussed in

-6 - general, but only a simple model is presented in an example. In the example Kinney assumes the compliance rate to be one of eight values ranging from.86 to 1.0. The probability link to the hypothesis test of details is given by multiplying an assessed system evaluation reliability times the compliance rate, posterior to the compliance testing. He states that the choice of this model is "difficult to justify" and that it has been used for simplicity of presentation. The system-evaluation compliance-testing part of our model has been arrived at by considering the components that cause an error. We also link the compliance error rate to the substantive error rate. Felix and Grimlund (1977) use a Bayesian approach to model the substantive test of details. In order to provide a posterior distribution on the total monetary error they assume a binomial distribution for the number of errors observed and a normal distribution for the size of an error conditioned on its existence. Conjugate priors, beta for the error rate and normal-gamma for the size, are used. The Felix-Grimlund approach is similar to our model of the substantive test of details. However, we employ the methodology of Cox and Snell (1979) which models explicitly for the small error rates typical of many aud it ing populat ions. In another Bayesian decision theory approach, Scott (1973) considers the substantive test of details, but his sampling unit is "all transactions processed in a single day." This approach to sampling does not seem amenable to most auditing situations. Neither Felix and Grimlund nor Scott attempt to link the results of systems evaluation and compliance testing directly with substantive tests of details. Of course, the prior distributions which they employ as inputs into the substantive test of details are supposed to contain in a subjective form the information attained during system evaluation and compliance testing. The model we are proposing provides a direct link.

-7 - 3. GENERAL BAYESIAN MODEL OF THE AUDIT PROCESS The sources of audit information must be combined to allow the auditor to form an opinion. In order for the process of combining these sources to be coherent, the probabilities must be revised according to Bayes' theorem. The purpose of this section is to describe the general Bayesian model and to define the symbols and notation. As stated in the introduction, the auditor wishes to make a statement about the total error in a single financial statement class if icat ion. The notation and format of presentation used to develop the model for the total error will follow those used by Cox and Snell (1979) and by Moors (1982). Consider a finite population of N items in which each item i has a known N recorded value X. > 0. Let T = I Xi be the total recorded value. The 1 x i 1 audited value of the ith item is X. - Y., and therefore the amount of error 1 i in the ith item is given by Y.. We assume 0 < Y. < X.. Therefore, this 1 - - 1 model is restricted to overstatement errors. N Let T = Y Y. be the total error in the finite population. Define i=l d. i 1 if Y. 0 d(0 if Y. = 0. if Y O. N N Then T = X d.X is the total of the recorded items in error, and M = d. ~xd I 1 i=l i=l is the number of items in error. We define Y. Z -X i=l, 2, N (3.1) i 1 so 0 < Z < 1, and Z = 0 if and only if d = 0. For those M items with d. = 1 - -- 1 1 1

-8 - we assume that Z1, Z2,..., Z is an independent, identically distributed realization from the conditional distribution f(zld=l) with E[Z|d=l] = p. For all i, we assume that P[Yi > 0] = P[Yi > 0IXi] = ). (3.2) That is, the probability that an item is in error (represented by 4) is constant and is independent of the recorded value X.. Consistent with most audit populations we assume that the value of 4 is small. These definitions enable us to write the defining equation: Txd T y T x T x T x xd which says that total error in population = (proportion of recorded monetary value in error) x (total fractional error) x (recorded total). Since most audit populations have many items (i.e., N is large), we will use the following limiting arguments: Td T xd \., T -— >> and Y - x xd and, therefore, T > ~jT. y x We will focus attention on 4)pT since this parametric representation lends itself to a Bayesian analysis. To aid in the presentation of the general model we define: SE = the evidence obtained from the system evaluation, CT = the evidence obtained from the compliance test, ST = the evidence obtained from the substantive test, and AR = the evidence obtained from the analytical review.

-9 - Since the two quantities of interest are < and i, we will construct a joint posterior distribution of these quantities given the first three sources of information listed above which we write as f((, p[SE, CT, ST). In this paper we will not explicitly model the information from analytical review, which is considered to be a source of information available after the other three sources. This is consistent with the audit process model formulated by Loebeckke (1981). Both the substantive test and the analytical review pertain to the final monetary values in the financial statement classification; therefore, the order in which they are executed is a matter of choice and judgment on the part of the auditor. Our formulation is for the convenience of the model development. In the concluding section we comment briefly on how the information from analytical review could qualitatively revise the posterior distribution derived. In modelling f((, p|SE, CT, ST) we link together an error rate model and the Cox-Snell (1979) model for the substantive test. The error rate model uses system evaluation (SE) and compliance testing (CT) as sources of information and provides as output a distribution on 4, the error rate. This distribution on ( is then used as part of the prior distribution input to the Cox-Snell model. The other part of the input is a prior distribution on p, the mean fractional error. The output from the Cox-Snell model is a posterior distribution on the product, (p. Figure 1 is a block diagram of our general model. The four sources of audit evidence are presented in the order in which they become available. In addition, there is a block which represents the error rate submodel. The specifics of the three inputs to that submodel will be discussd in the next section.

-10 - Notice that we require that four prior distributions be formed out of the system evaluation. Three are on components of the error rate and the fourth, f(IpSE), is a prior on the fractional error. The compliance test provides updating information on the quantity (a), which represents the percent of erroneous accounts to which the internal control system was not applied. The substantive test of details updates both 4 and p. Finally, the indirect information available from the analytical review revises the distribution on dpT. We now concentrate on the modelling aspects that enable us to find the posterior distribution f(c, PISE, CT, ST). We can write f(~, ipSE, CT, ST) a f(ST|J, 1, SE, CT) f(CTI, p, SE) f(4, pjSE). (3.3) To simplify the right-hand side of (3.3) we make three assumptions, all of which are reasonable in the context of the audit process. First, we assume that the prior distribution of 4 and p are independent conditional on SE, i.e., f(~, pISE) = f(jISE) f(pISE). (3.4) This independence of the error rate and the fractional error is true if we assume the error rate to be a constant, c, as in (3.2). The compliance test yields information about the error rate and does not contain monetary information. Therefore, as our second assumption we write f(CT|(, p, SE) = f(CTI, SE); (3.5) that is, conditional on 4 and SE, the compliance test (CT) is independent of pThe third assumption is that given 4 and p the substantive test (ST) is independent of both the system evaluation (SE) and the compliance test (CT), that is, f(STJ|, p, SE, CT) = f(STj|, p). (3.6)

-11 - Using (3.4), (3.5), and (3.6) we can rewrite (3.3) as f(i, pISE, CT, ST) f(pISE), f( |SE, CT) f(STI ), u). (3.7) The right-hand side of (3.7) has three components which must be modelled. The next section presents our model for each component. 4. COMPONENTS OF THE BAYESIAN MODEL The three terms on the right-hand side of (3.7) will now be modelled to take into account the source of audit information. Both f(p|SE) and f(STI|, i) will be modelled as in Cox and Snell (1979). The term f(j| SE, CT) will be modelled by considering three components of error which combine to form the error rate of interest, ), as proposed by Thompson-McLintock (1982). The importance of our treatment of this problem is not so much the manner in which we model the components of (3.7) but the way in which these components link together to give the auditors a meaningful posterior distribution. 4.1 Prior Distribution of the Fractional Error Rate: f(pjSE) Cox and Snell (1979) assume an inverse gamma distribution for p, p0(b-l) P0(b-1) b exp{-(b-l)p / } f(pISE) = 2 P-, P r(b) where E[p] = O. The support of this distribution is [O,c], but under our model the permissible values for p are [0,1]. However, the parameters PO and b can be chosen to make P[p > 1] arbitrarily small. In an attempt to make the notation of Cox and Snell easier to read, Moors (1982) defines X = -1 and then assumes that X - r(a, ); ie a-1 -gx i.e., f(XISE) = gaa- /r) for > 0. (4.1) This is equivalent to Cox and Snell's distribution assumption on B, with a=b and g=p0(b-1). The support of (4.1) is [0,oo], but the permissible

-12 - values for X are in [1,w]. This will not cause problems if (a,3) are such that P[X < 1] is small. It is easier to make a subjective assessment about the values of p, since it is the fractional error rate, than about X. Since E(p) = p0, S.D.(p) = po/(b-2)12, we require the auditor to specify the values of the mean and standard deviation of p after assessing system evaluation. These values determine p0 and b and hence a and B. Since we are now using the inverse of the mean fractional error, X, instead of p, we will rewrite (3.7) as f(q, XJSE, CT, ST) af(STj|, X) f(flSE, CT) f(X|SE). (4.2) The limiting total error, on which we wish to focus, is then given by ~ T Xx 4.2 Prior Distribution on Error Rate: f(+(SE, CT) In order to develop this component we will discuss how errors are generated and how they are detected by the internal control system. We follow the definitions given by the chartered accounting firm, Thompson-McLintock (1982). Inherent Error Rate (i). When an account balance for a line item is generated there is a possibility that it will be generated wrongly. Define the inherent error rate (i) to be the proportion of items that are generated in error. Application Error Rate (a). The population of account balances will be subjected to the internal control procedures. However, these procedures will not be applied to all of the accounts. When sampling an account balance line item, an auditor can tell if the internal control procedures have been applied. Whether or not these procedures have been applied is an audit definition which must be specified by the auditor. We define the application error rate to be the proportion of the accounts which are in error that have not had the

-13 - internal control procedures applied to them. Notice that this definition includes only those items in error. The significance of this assumption will be discussed below when we update our knowledge about (a) on the basis of the compliance test (CT). Detection Error Rate (d). Even when the internal control procedures are applied to an account in error, it is not the case that they will necessarily detect the error. Consider all the accounts which are in error and to which the internal control procedures have been applied. Then, the detection error rate (d) is the proportion of those accounts for which the error is not detected. Residual Error Rate (p). We have been referring to this error rate without the modifier residual. It is the proportion of accounts that remain in error, and is therefore the error rate that exists at the time of the substantive test of details. Residual errors can occur in two different ways. (1) An inherent error can occur in an account to which the internal control procedures are not applied. The probability of this occurring is given by (ia). (2) An inherent error can occur in an account to which the internal control procedures are applied but the error can go undetected. The probability of this occurring is given by (i(l-a)d). Therefore, = ia + i(l-a)d = i(a + d - ad). (4.3) Figure 2 is a schematic diagram of the methodology we prescribe to determine f(l|SE, CT). On the basis of the system evaluation, the auditor must specify the mean and standard deviation of all three basic error rates: (i), (a), and (d). These values are designated pi, ai., a' a, pd' ad. As stated earlier, the compliance test (CT) provides information about the application error rate (a). The compliance test is a sample from all of the

-14 - accounts, not just those in error; therefore, in order to use the sample information from CT to update (a) we assume that the probability that the internal control procedures will not be applied to all accounts is the same as the probability that they will not be applied to erroneous accounts, which is (a). The application error rate, (a), is assumed to be small, since auditors would not extend the effort to sample procedures which they did not believe were highly reliable. Let R be the number of application errors observed in the compliance test based on a sample of size k. Then we assume R - Poisson (ka), that is, P[R=r] = eka(ka) /r!, for r = 0,1,.... We use the conjugate prior for the Poisson so that (a) - r(e,). Equating the moments of the gamma distribution to the mean and variance assessed on (a) we have 2 2 e = a/a, 2 = pa/fa a a Then, based on the compliance test, the posterior distribution of (a) given R=r is 2 -2 -2 r[p a + r, p a + k). aa a a So the posterior mean and variance of (a) are given by 2 -2 -2 a = (a + r)/(v a + k), and 2 2-2 -2 2 (,)2 = (pa 2 + r)/(p a + k)2 a a a a a where substituting the value (a') for (a) indicates that it has been updated via the compliance test. We now use (4.3) to find p and a2. Under the assumption that (i), (a'), and (d) are independent it can be shown that: E[i(a'+ d - a'd)] = pi[a, + pd - aPud]

-15 - and 22 22 2 2 Var[i(a'+ d - a'd)] = oi '+ P a + Pa d-a d i a'+ d-a d i '+ d-a'd a'+ d-a'd i' where 2 2 2 2 2 2 2 aa+ d-a'd =a a( 1-d) + ad(lPat) + a td. Therefore, we can set pi = E[i(a'+ d - a'd)] and ao = Var[i(a'+ d - a'd)]. Furthermore, we assume that ) r(y,6), with 2 2 Y = p/Ia and 6 P 2 This gamma distribution provides the component f(|ISE, CT). 4.3 The Likelihood of the Substantive Test f(STI|, p) This component incorporates the sample information from the substantive test. We work with A=p and adopt the same assumptions as Cox and Snell (1979) and Moors (1982). A sample of n accounts or line items is selected at random from the financial statement classification being audited. Each selected item is audited for the correctness of its recorded monetary value. If an item is in error, the fractional error Z. is noted where Z. is defined by (3.1). Given that an item is in error, we assume that Z. is exponentially distributed with parameter X, f(z.i|d=l, X) = Xe- i; Z. > 0 Let m be the number of items observed to be in error out of the n sampled. We assume m is Poisson with mean n. Define m Z = Z.. i=l

-16 - If the Z 's are assumed independent, then Z P r(m,X). It then follows that f(STj|, X) = f(m, Zl|, X) = f(Z|m, X) f(ml)) = r(m,X) x Poisson (n)). cm -n( Xm -AZ a ( e X e 4.4 Combining the Components Based on the modelling of the three components of the right-hand side of (4.2) we can write f(4), XASE, CT, ST) ey)m-1l e -(6+n) c m-l1 +z (4.4) Since we wish to focus on the limiting total error, XA Tx, we define -1 the total fractional error 4 = 4). From the posterior distribution (4.4) we see that 4 and X have independent gamma distributions; that is, if f(), X|SE, CT, ST) - rP(y+m, 6+n) x r((a4m, f+Z). It then follows that (6+n) (ct+m) (y4m) (3+Z) ' - F[2(y4m), 2(c+m)]. As can be seen there are seven constants that define the posterior distribution of 4, namely a, O, y, 6, n, m, and Z. In Table 1 the sources of these seven quantities are summarized. In the next section various cases are considered and measures of the resulting posterior distributions of 4 are discussed. 5. EXAMPLES AND CONCLUSIONS In this concluding section we demonstrate the model and comment on the results. To develop the examples we must set prior parameters and specify the sample results from both the compliance and substantive tests. We consider

-17 - three cases (A,B,C) for the settings of the prior parameters and two cases (I,II) for the sample results. This gives six examples to compare. Case A represents the situation in which the auditor believes before the sample is taken that there are few errors in the population. This is the most typical case because the auditor is often using the sample results to reinforce the strong belief that' the account is fairly stated. Case B gives settings for prior parameters that indicate a lack of knowledge about the size of the error rates. In this case the prior means are all set at.5. In Case C the priors are set to indicate the auditor's belief that the error rates are high. Sample data I typifies the auditing situation in which no errors are found. With sample data II we find errors at both the compliance stage and the substantive stage. Table 2 gives the values of the prior settings, the sample data, and resulting measures of the posterior distribution of the total fractional error, t. The values P (u=.10,.05,.01) give the probability that no more than a u proportion u of the recorded value of the financial statement classification is in error. These measures are valuable to the auditor because they will provide support that a statement is fair if the total error is no more than some percentage of the total recorded value, that being the way materiality is often defined. The other measures reported in Table 2 are the ninetieth, ninety-fifth, and ninety-ninth percentiles of the posterior distribution of i. These values give the upper limit of the one-sided posterior credibility intervals on the total fractional error. As can be seen from Table 2, a larger proportion of the distribution of * is close to zero for sample data I than for II. This is coherent since sample I showed no errors. Also, going across that table from case A to B to

-18 - C, the mass of the posterior distribution of 4 moves away from zero. Again, this is coherent since the prior settings of case A are closest to zero and those of case C are furthest away from zero. On the basis of these six examples, as well as other passes through the model not explicitly reported, we conclude that the model is responsive to changes in the prior assessments and to alternative data sets. For example, consider the situation in which an auditor has decided that a 5 percent overstatement can be tolerated and that he/she is willing to run a 10 percent risk on this part of the audit. This willingness to have a 10 percent risk may result from having run or planning to run other supplementary procedures such as analytical review. This is consistent with professional standards as given in the "Statement on Auditing Standards, Number 39" (1981). From Table 2 both samples under case A would allow the auditor to conclude that the financial statement classification is fairly stated, since 90 equals.000 and.048. Under case B the error-free data allows the same conclusion (Y 9=.006); however, the sample data II case indicates a fractional error rate of 5.4 percent at the 90 percent credibility level, which may not be acceptable. In our model the evidence from analytical review is incorporated after the substantive test of details (see Figure 1). This evidence consists of comparing the financial statement classification balance with other sources of financial data. We are suggesting that the analytical review evidence should be used subjectively to revise the posterior distribution on (pTx, the total monetary error. The analytical review evidence will either confirm or conflict with the decision that would result using f(((pTx SE,CT,ST). If the evidence is confirmatory, it serves to strengthen the final conclusion. On the other hand, if

-19 -the analytical review evidence is conflicting, the various sources of evidence must be judgmentally weighed to reach a final conclusion. In conclusion, we have developed and demonstrated a Bayesian model which links the prior assessments, the compliance test, and the substantive test. The model is responsive to changes in prior settings and to the sample results. This model incorporates all aspects of evidence gathering in the audit process. The formal analysis should be a guide to auditors in analyzing sample procedures on a single financial statement classification.

-20 - REFERENCES Codification of Statements on Auditing Standards (1982), New York: American Institute of Certified Public Accountants. Cox, D. R., and Snell, E. J. (1979), "On Sampling and the Estimation of Rare Errors," Biometrika, 66, 125-133. Felix, William L., Jr., and Grimlund, Richard A. (1977), "A Sampling Model for Audit Tests of Composite Accounts," Journal of Accounting Research, 15, 23-41. Kinney, William R., Jr. (1975a), "A Decision-Theory Approach to the Sampling Problem in Auditing," Journal of Accounting Research, 13, 117-132. (1975b), "Decision Theory Aspects of Internal Control System Design/ Compliance and Substantive Tests," Studies on Statistical Methodology in Auditing 1975, Supplement to Journal of Accounting Research, 14-29. Loebbecke, James K. (1981), "Auditing Research State of the Art: Auditing Approaches, Methods, Programs and Procedures," Paper No. 81-27, prepared for Peat, Marwick, Mitchell & Co. Audit Research Conference, May 26-27, 1981. Moors, J. J. A. (1982), "Bayes' Estimation in Sampling for Auditing," The Statistician, in press. Scott, William R. (1973), "A Bayesian Approach to Asset Valuation and Audit Size," Journal of Accounting Research, 2, 304-330. "Statement on Auditing Standards Number 39" (1981), issued by the Auditing Standards Board, American Institute of Certified Public Accountants, New York. Thomson, McLintock & Co. (1982), "Statistical Sampling," typescript.

-21 - System Evaluation f(al SE) f(ilSE) f(dISE) I L~~~~~~ f(a SE, CT) l Error Rate Submodel f(, p|SE, CT, ST) f(4pTxlSE, CT, ST) Analytical Review f(+pPTxISE, CT, ST, AR) Figure 1 GENERAL BAYESIAN MODEL OF THE AUDIT PROCESS

-22 - System Evaluation I:~~ ~~~~~~~~~~~ t.. 1 1 a a a (,) a ~ r(e, ~) i Ed ad i a ~ r(e',C') a' a' a1I 7 I p* a 9 - r(y,s) Figure 2 ERROR RATE SUBMODEL

-23 - Table 1. Summary of the Sources for the Posterior Parameters Source Posterior Parameter System Evaluation Compliance Test Substantive Test a Assessed by auditor Y i,, 2,o 2 i 2 a a 2 k = sample size i i a a d d 6 Assessed by auditor r = number of errors n n = sample size m m = number of errors z z = sum of the fractional errors

-24 - Table 2. Examples of the Posterior Distribution of the Total Fractional Error (p)a Prior Parameters Case Case Case A B C 3 V =.5 =.5 1 i=1a =1 d=.l i.=O =0 =.3 1 ad, =.5 jJi=a =1d=.5 o.i= =C =. 5 1 a 1 =.9 a =.3 p i=a =11 d=. 9 oi=o = d=.'3 iad Sample Data I k=100, r=O n=60, m=0 P =.10 P =.05 P =.01 ~.90 =. 95= '.99 1.000.999.999.000.000.001 P = 1.000.10 P 0.998.05 P0=.952.01 '.90 =.006. 95 =.010 P =.025.99 P.10 P =.05 P -.01 ~.90 = '.95 = '.99.873.458.006.108.131.187 Sample Data II k=100, r=5 n=60, m=2 z =1.0 z =0.8 2 P.10 P =.05 P =.01 - ~.90 = '.95 '.99 =.986.907.289.048.064.111 P =.981.10 05.883 P0 =.227 t.90 =.054 ' 95 =.071 '.99 =.121.99 P =.656.10 05.158 P =.000.90 =.151 '.95 =.178 '.99 =.244 a(p = P[' < u]; p is the pth percentile) U - p