An Expert SysteDl
for Financial
and Accounting
InforDlation
SysteDl Auditing
J. Akoka and I. Comyn-Wattiau
II
xpert systems have emerged
in the past ten years as com-
puters programs that draw on
the expertise of one or more
human experts (Silver m ann 87). One area
of application of expert system s is the
financial and accounting domain. There
are five functional areas of accounting:
auditing, management accountin g (plan-
ning and cont rol systems), tax , financial
accounting, and accounting information
systems. The purpose of thi s section is to
review the work that has been done in
this area and espe cially expert systems
applied to financial and accounting infor-
mation system auditing.
Currently, there are few expert systems
that have been developed and applied to
the accounting area. The most important
are:
AUDITOR, developed to make
diagnostic judgment concerning the
adequacy of a firm 's allowance for bad
• Comp.uter Audit Update· October 1997
© 1997, $17.00 Elsevier Science Ltd.
•
debts (Dungan, 83, 85, and Dungan &
Chandler, 83, 85) .
- EDP AUDITOR, developed to assist
in the audit of c o m p u t e r i z e d
a ccounting sy stems (Ha ns e n &
Mes sier, 82 , 85a, 85b) .
AGGREGATE, developed to aid in
the design of accounting information
systems by de veloping aggregate
financial statements in order to
improve management decision making
(Munakata & O'Leary, 85).
ICE, designed to aid in internal
cont rol evaluation (Kelly, 84).
TICOM , developed for internal
co ntrol evaluation (Bailey et al., 85).
TAXMAN , produces the tax
consequences of corporate reorgan-
izations (McCarty, 77 & Miller 84).
Other prototypes include accounting
expert systems developed by (Braun, 83,
Dillard & Mutchler 84, 86, Meservy 84,
Biggs et al., 86, Willingham & Wright, 85,
Dillard et aI., 84, 86, Reitman 85,
Michaelsen 82a, 82b, 84, Akoka &
Comyn-Wattiau, 96).
It is apparent from this brief review
that there are few applications developed
in most ofthe functional areasofaccounting.
In addition, there are almost no application
in computerized accounting systems
auditing. The aim of INFAUDITOR is
precisely to perform this audit process.
INFAUDITOR provides a rigorous
framework and an aid in the accounting
and financial information system audit
process.
The rest of this paper is organized as
follows:
Section 2 is devoted to a description
of INFAUDITOR's framework and
functionalities.
Section 3 presents a case study. A key
issue centres on how to apply
INFAUDITOR in accounting and
financial information system auditing.
It presents the results obtained by
using INFAUDITOR in auditing the
Current audit settings
.;~ Sub-domains
E
Q
-e
-
tr:
Elementary domains
Figure 1. INFAUDITOR conceptual framework
accounting information system of a
French company.
Section 4 gives conclusions and
describes further research directions.
Concepts and
framework
In an audit situation, INFAUDITOR
takes into account three aspects:
the enterprise (size, structure,
products, markets, ...)
the existing information structure
described along four major
dimensions: organiz-ational,
technological, human and financial
the audit objectives assigned for the
mission and related to one or several
Computer and Information Systems
(CIS) domains.
The application of audit criteria to
computer and information systems
domains leads to the conceptual frame-
work represented in Figure 1 for a given
enterprise described by its information
•
Computer Audit Update· October 1 9 9 7 .
© 1997, $17.00 Elsevier Science Ltd.

Domain Sub-domains
Accounting General opinion
and Finan ce Lon g Term Planning
Transaction Rec ording
System Adequacy
Figure 2. Hierarchical Decomposition of an Audit Domain
system characteristics and the audit objec-
tives. The main concepts used in this
framework are the audit domains, the
audit criteria and the audit tree.
2.1 Audit Domains
Auditing Computer and Information
Systems can be performed along dimen-
sions related to the following domains:
the m anagerial dimension of the
information syste m including: th e
information sys t em strategy, the
Root
Figure 3. INFAUDITOR: The Hierarchical Tree
II Computer Aud it Update· October 1997
© 1997, $17.00 Elsevier Science Ltd.
Sub-domains or Elementary
elementary domains domains
- Long Term Plan Existence
- Precision Level of the Plan
- Up date Frequen cy of the Plan
- Scope of the Long Term Plan
- Specific Perfor mance Variables - R etu rn on capital
empl oyed
- Profit margin
- Annual turn over of
capital emp loyed
- Fixed charge covered
- Existence and Quality of
Infor mation N eeded for the
Plann ing
fun ctional inform ation sy st e m s
(marketing i n fo r m at io n sy st e m ,
human resource informa tion system,
logistics inform ati on system,
accounting and financial information
system, etc.); the data processing means
and organizational procedures; the
management control of the
information system function,
the technical dim ension encompassing
the following domain s: co m p u ter
sec u r i ty, l aw and tr aditional
acc o un ting co nfo r mi ty rules, data
processing operat i on s, c u r r e n t
T2, I,1 (W 2, I,l' G 2,1,d
)---,.T2,1,2 (W2,1,2 ,G 2,1,2 )
T2,l, 3(W2,I ,3' G 2 ,1,3)
T2,2 (W 2,2 , G 2,2 )
 applications, new information system
projects, information system costs,
purchase and subcontracting,
telecommunication and network
systems.
Each domain is then divided into sev-
eral subdomains. One subdomain may
belong to several domains. For example,
the application security sub domain
belongs to both the computer security
and the current application domains. sub-
domain is elementary if and only if it can
be evaluated using one specific audit test.
An example of subdomains and elemen-
tary domains is given below for the
accounting and financial audit domain.
Subdomains (like General Opinion)
that cannot be decomposed represent ele-
mentary domains on which test of con-
trols can be performed. This is also the
case for Long Term Plan Existence. On
the contrary, specific Performance
Variables is not an elementary domain
since it can be decomposed on Return on
Capital Employed, Profit Margin, etc.
2. 2 Audit Criteria
To satisfy business objectives, information
systems domains need to conform to cer-
tain criteria allowing adequate control
measures. These criteria can be segmented
according to three vantage points:
Quality requirements of outputs
encompassing efficiency and
performance
Security requirements described by
the criteria of consistency, security,
conformity and reliability
Readability requirements comprising
feasibility, auditability and ability to
evolve.
Efficiency is concerned with the
amount of resources required to achieve
business goals. It also concerns the provi-
sion of timely and adequate information
in the most cost effective manner.
Performance reporting measures the con-
tribution of CIS to the organization
objectives. Consistency ensures that CIS
are composed of homogeneous and
coherent subsystems. Security and protec-
tion concern the techniques used for pro-
tecting CIS from persons who are not
allowed to access a part of or the whole
CIS. They are specified in terms of autho-
rization constraints. Conformity relates to
legal aspects. Reliability deals with infor-
mation and computer resources being
reliable with a minimal failure rate.
Feasibility can be evaluated in terms of
organizational, economic, technical and
operational investigations. Auditability
relates to the ability of auditing a part of
or the whole CIS. Finally, the Ability to
evolve deals with CIS being able to
change and to adapt to new situations.
In order to satisfy organizations' objec-
tives, the domains (subdomains and ele-
mentary domains) need to conform to all
(or part of) the criteria defined above.
2.3 Audit Tree
The fundamental feature of INFAUDI-
TOR framework is that audit domains
and audit criteria can be combined to
form a hierarchical tree defined as a finite
set of nodes such that:
the nonterminal nodes represent the
audit domains and subdomains (i.e.
development methodology, system
characteristics and documentation,
system security, accounting and
financial information system, etc.)
the terminal nodes represent
elementary domains to which the tests
of control must be applied.
INFAUDITOR considers two types of
tree:
- a general tree covering all the
information system domains and tests
of control,
- several non-independent subtrees
corresponding to the audit of
particular information system
domains.
When auditing a particular domain
(for example accounting and finance),
weights are attributed to the nodes of the
general tree, leading to a customized sub-
tree. For each test of control, a grade (or a
Computer Audit Update' October 1997 •
© 1997, $17.00 Elsevier Science Ltd.
 MANAGEMENT
FRAMEWORK
·· Organization
Financial Goals Objectives.
&
Principles of the FinanceFunction.
&
·· Accounting Principles Policies.
FinancingCommitment SigningAuthorities.
&
&

StrategicPlanning
·· Long-Term Financial Planning.
Assets & Finance(Capital) Structure.

M
A
N
TacticalPlanning
·· Annual Budget.
Capital Expenditure Plan.
A
G
· Proiected Financial Statements: Short-Term Financial Planning(Balance
Sheet IncomeStatement Cash Flow).
E
M
E
Management
Control
· Budget
Comparison of Actualvs. PlannedFinancial Statements Operating Expense
Control.
&

··· InternalAudit
N Funds Analysis.
T Debt Administration Control.
&
Control.
&
I
N
·· Other Performance Measures : Ratio Analysis.
Cost Control Variance Analysis (Standard Costs).

F Working Capital Existing Fixed Revenues &

0 Assets Operating Accounting
R Costs
M
A
T
·· Cash Treasury
&
Cash receipts
· (cost
Acquisition
of
· Billing
Invoicing
·· Responseand
Cost Centre
&
I
0
·· PettyCash
ForeignExchange
·
fixed assets)
Expected ·
OrderEntry
Inventory
·
Reporting
General Ledger
N Data Management
(Recording and
· - Payments
Accounts Payable Life
Depreciation
&and
Materials
Financial
Statements
&

S Inputting - Currencies of Fixed Ordering (Debits/Credits)

y
S
Transactions)
·
- Discount
Accounts
·
Assets
Revaluation
· Production
Cost
· Overhead
Allocation
T Receivable of Fixed Accounting
E
M
- Aging
- Collection ·
Assets
Recordof
· Payroll

Maintenance
Costs
· Debt
Service

Figure 4. Information requirements in Financial and Accounting Information Systems (adapted

from Segura 85)

qualitative appreciation) is given to the
terminal nodes of the subtree. The weights
and the grades enable the auditor to
determine scores for different domains,
leading to an aggregate audit score. Based
on these evaluations, the auditor can
choose the opinion that best classifies the
client's information system. The structure
of the audit hierarchical tree is represented
as follows (Figure 3) where D stands for
domain, SD for subdomain, T for test, G
for grade and W for weight. For example,
the test TI,2 results in a grade GI,2, the
domain DI can then be evaluated to WI
I*GI 1 + WI 2*GI.2. Then DI evaluation
will be weighted by WI in the global eval-
uation grade.
All the grades are given using a quan-
titative scale. At any level of the tree, the
sum of the weights of a node's children is
equal to 1. The weights of the nodes indi-

Computer Audit Update' October 1997

© 1997, $17.00 Elsevier Science Ltd.
..
cate not only their participation III the
final evaluation, but also the tests the audi-
tor should perform.
The general audit tree is very wide,
since information system auditing
involves many domains. An originality of
our system is that it covers all the aspects
of information system auditing while
authors usually focus either on the man-
agerial aspects (accounting and financial
information system, human resources
information systems, logistics, etc.) or on
the technical aspects (computer network,
system security, applications, new pro-
jects.etc.). INFAUDITOR thus incorpo-
rates the knowledge of the different
expertise domains of information systems.
Dor11 in
,('ocfoll Opimon
S'''lrlC' Plan m ne
T. IIc.1 l' u nmnlC
t .ln .lttt'U K nt Control
Ihu
- 1 1 n .l ~ (' m (" 0 1
Tuny lion R . onlmlC ) tern
Bu ann Environment ' o nlt
Inforn u llo n R . ordrng
Fm"an ul ..nd Acco unnng
The general audit tree is implemented
by rules. For each node of the tree (repre-
senting the domain or the subdomain to
be audited), a rule represents the link
between this node and its parent. Storing
the tree by rules makes it easy to maintain
and favours a prototyping approach. The
enrichment of the tree requires only
adding new rules, without having to
rewrite the whole structure. The other
(and main) application of rules in
INFAUDITOR is in the customization of
the general audit tree. The rules deter-
mine the weights of the nodes in this tree
according to the following parameters:
the enterprise (general characteristics
like size, industry type, products,
markets, environment, strategy)
the information system being audited,
especially weak points revealed by
previous audits,
the objectives of the audit, especially
the mission assigned to the auditors.
This section has introduced the basic con-
cepts of INFAUDITOR in both qualita-
tive and quantitative forms. INFAUDI-
TOR uses a hierarchical tree adding to
the expert system a new dimension of
modelling. By combining expert system
approach and hierarchical modelling,
users have at their disposal a powerful tool
that facilitates extensive experimentation
in information system auditing.
3 Accounting and
Financial Information
Systems Auditing Using
INFAUDITOR: A Case
Study
7/ 11I
The objective of a Finance and
11.1 5.11/l0
Accounting Information System (FAIS) is
o.t 6.2/10
to provide management with relevant and
o.t 6.1 /10
n .2 7.5/10
timely information for (Segura 85):
0 .2 7.9110
Financial planning and decision
o r U1 ~ n .1 7/ 10
making
11.1 11 /10
Exercising control over financial
activities
11.115 1./111
Facilitating the coordination of the
financial requirements of the varIOUS
functions of the enterprise.
In general, a FAIS is designed to:
Collect, record and store data
Provide the data retrieval
Transmit and present relevant
information.
The use of a FAIS may be categorized in
terms of business processes of:
Strategic planning
Tactical planning
Management control
Transaction recording system.
The figure below describes the main fea-
tures of a FAIS (Figure 4). These features
of a FAIS can be used to build an audit
framework comparable to the one pre-
sented in Figure 5. The resulting audit
process has been applied to a French divi-
Computer Audit Update· October 1997 •
© 1997, $17.00 Elsevier Science Ltd.
 R
General orinIon
IU1tlti punnmtt
Long term tnlC'~. firuncl.a1 pun C'. 1~IC'n (' o.z
I'r<CI ion InTI of the pun n.1
Up<Ll~ fr<'lu~nC)' of the pun 0 .1 5
Up<' of th e \onl( term pun n.2 5.7
omplere pro -forma finan 1.11 ,,"UICI11C'1lt n.:! (,

J)nlrt'd .l"\("( rru cture n.1 5

Dnlr<d tin.n<lntt tructure (d ebr, equiry, self finan cing, etc , . .) n.:! 7
RI k nun.1 remem (msurance, foreign exchange exposure) n.1 5
'1 Impact on lin.anc(' of ocher ( a rpor,lIe progr.Ull n.:! 5
III D1UubutlOll\. corpo r.3lC' credu r.lnk 1~. n ' c. J'O'Uf'C' n.1 (,

II pt:'Cltic pertoruun C' \·,ul.lhln n.1 ~

12 Ex. ren ee and qU.lht)' of mformauon

needed 10' the punl\lnl( U.I
1\ Con I '~I" ') ' wuh the R 'D and other pun U.2
TJiCu c~1 runnml't U.I
I Short term UCti .11 tirun ul pun ('X.~ICn C' U.:! 7
I 1'r<<I Ion In I of the pun U.I h
II> Up<L1< n~ul' f ')C of rhe pun 11.1 H
ope of the hort term pun CJ.2 5.5
I" Anl1uJ.1 bud ·('1 o.z (,

I Ca h md w rkmc colplul requuemem U.I 5

1'1 ProJC'ctC'J qUoIn('rl)' income LUC:I11CI1I and balan C' heer n.1 (,

!II R cbuon hlp to Ion r-rerm tirun 1.11 pun U.:! 7

21 'oolti anon 10 pollnC'\ on tun~ cred it. tn\TntofY holdm • n.:! ~

Imp.l t on tiruncr of the a U\'U1n of other co rpa u le tun cnon, U.:! 5

1-' Spc'Clti pcrtornunc(' vuubln U.I (,

:!~ EXI ren ee "lI1Jqwhty of mformauon nC'C'JC'1J lor (he plmmng U.I 7
15 Con "I<n <)' wuh the R '1> and other pi"" O.:! 5
'ol ~C'I1 rn control U (, 1
:!I> MolJor lillolncC' and accounnn • rt'pon C'Xl'\(C'ncC' U.3 5
2" pc lollrt'port C'xl~(n C' 0 .1 (,

Up<L,~ lR-qu~<) ' of the r<port U.I 7

A\ "',.uublC' mfornuuon for monucrmg linolncul ~ CU\ "UlI:" 0 .1 5.'J
I'A,tiLlh,lll)' (~ . I( .. from 0p<'UIIOll . other 1('111 sud I",,,,,) U,4 5
LI'luld,')' .lld working "plLlI pouuon. (c> h. • mum .et ...) U.3 7
Solven )' .lld long -term lin.n ..I po<Il10ll (deb,). U.-' It
Pertornun C' mea urI:" prepared lor management 0.-' 7. 1
33 Return on "plLlI employed 0.2 7
3-1 Profit nur~1O • Profir before 1O(C'r('\( ux /$.Jln 0.1
35 Annu.1 turnover of "p'L11 employed U.l
.l6 "urrt'fl( rano e urrern ,lUC( / C urreut habrhnes U.l 7
37 ollecnon peerod e cco unu receivable /
A\TUI(~ .1.1\)' ....I n 0 .1 t,
In\Tn(Ory (urno\"C'r · 0\( of ulC"'\/ln\'t'n(orlC'" 0 .1 7
Fixed charge cove rage 0 .1 H
Toul debt \CO"I t: cO\'t'r.lgt: 0 .1 7
Lon e-terrn JC'b(/C'qult)' rano 0.1
DJU nUnJ"'P("OlC'nl o ~
Il rm Ipoll fit" . md record of firun e and J co unn ng mfornuuon O.:! H
11011 IC'\ on retennon of finance and Jccounung record 0 .1 7
FIling ) (C'111 used (0 provide J CC("\ (0 III fil JnJ record 0 .1 H
Flln and record ph ,,,1 'Ofllll( 0 .1 7
Opcraung unn able (0 JCCC" IOfornuuon from filC'\ JnJ
records that are nor under therr co ntrol 0.1
.lp.lbllny of (he C'J1(C'rpn\(' (0 mnntam J lUU
b.", for finan ..I .n.ll I 0.\ 7
Don rhe ~mpfl'" 0l"'~ II own Ell!' 1:'<lII')'? 0.\ '1
) (C'm p~rnl) ' com pU(crl zC'1J In (hC'tiruncC'
SU~ nurugC'ttlcn( 0.1 7
50 EXI~(cn c of lI1·hou\oC' \) (C'ttl dnl!ll c;,a pJhlht)' 0.\
Tun lion f'('" onJmg ) (C'm JJcqw o 'J
51 E. I\ICII c of JIl J coununtt ') IC'1ll O.:!
52 ~lhu0J1 )f'n~ ' bookk«pll1tt 'I 1~ I o.:!
53 " ccruJI bUI of J counU" · 0. 1 7
5~ Ch.uI of J counU with J.II clements of (he fin.an ul \UIC'lllenl 0.1 'J
55 onlroh C'O ufang Iholl \OurcC'doculllcnt olfC'
com plC'I C'. olccurollCJnJ \~hJ 0.1 \II
onlrol\ an pucc 10 cn UfC' Iholl \Ource documcnl\ .lrt' 100u,lIly
r<m.J~d . ulJ."I7~d .nd po<l~d '0 kdl>"''' Oll • Wild)' b. " 0 .1 7

Computer Audit Update· October 1997

© 1997, $17.00 Elsevier Science Ltd.
• "pn aouaps Ja!AaSI3
L66l Jaqopo •
$~L"O
a~opdn

9
~6 L'
~!pn'v
@

;:);:)ll ~mp l
Ja~ndwo

P;:)PIdlUo::> lU;:)lSAS ~UJOI le ~OU

50 -0 UI.1)\.,\S uoJdns UOI\I),)( I ~Ul1uno)v
'aUIwnO::>::>e pue Ie~: >ue ~d
pur 1"..,urul:1
S dm'3~
( I>
50 -0 ~UlpJO.1 uourlllJoJul (I>
\0 )fuIJOJ1Umu UI,)UlUOJI.\U,) \\.JUhnn \6
L zo mno.>,,, (WUm)
J.l::ip,)llrJJu.J::i 0) J.l::ip.,ll-qn\ ).)1.\t' P..lxtl .10 UOIU'II"UO),)J .llpoU,)(1 (II>
9 <:-0 (' J),) '\.,llrJ ) ~ , U J I )DIIJx,) ' \ )U ,)U1.\ r J ~r,)1
' Ul J.J ) ,)\r"I'.\)l.)rJrJ p:urJ \uour.>t'u.)J\ ' J ~ U Jl U tlonr.ltluu"p.
JO
; \ r ~)n\ uourUIJOJUI ::iu1UlrmO.l \,)19 rI\~) ' 1',)\1'''1)0 ,)lU'U,)JUlr,

01 L'U .»),) ' \.olJ n p ,).>oJd ,))uru,))Ulrtu ',»)11 p,)u,)Jx,)

·.\JDr J r.> p"U'J JO \UOIJr.>t'''.ld\ ' 1M» 'J.»qUJnU uonr'tJUU.1pl
;\ r If'"' uonl"IJ~U ::iulUlnUOJ Ultl ),)\\r r')X~1 .10 ')')lU'U.lllllr,
h <:-0 \.o1)rJ uonrl .l,)Jd,)p rur
InoJ\IP '\lJOIJI\lnb,r)o UOIU"lIJ0t{)nr J.>Jt.uJ ,)J""Uo1 (}) 'I(Ulun,:)
L L'U "':imp
uOIJrI.),),Jd"J' rur \lnoJ\IP 'uo uo mboe \oJ,)"" ",)x9)0 \~UIPl U pur
.\) Ip llr.\ '.u r J n J.>r '\\.Ju.Jl.JldlllOJ .J41 ,JJn\u,J 01 "pJOJ,)J pur "IOJ1tIU
If! \ "n \,)Inr~1 ~UI.\Ol' Jltl ~ U 1 p n U 1 UI,)l\.\\ \}""\f p,))l;tJ)() ,)Juru,)1Uu'l
I. CO uout'..101 pur unpOJd .\q 41("t .\ JOIU.1\l 1l
UlOJ.1 \.,)0\\1 pur \ld1.)JJJ)O :iunuu J41 uo ,)NrJ1 ~\r uonrUlJ0.lul
OJ ~l. ufd.)J' \IP)O do
'\ ~ I 0 ) pur sauuuenb Ir JI\.\4d 01 \JUOJ,)J )0 uonrlllJtJOJ,)J JlpolJ,;).1
L t -o \-)lh\1 pur \ldIJJJJ .U OIUJ.\ UI ) O ~UlJ )0 \UU1PUJU pur
.{l IP IIt'.\ ',UfJOJJr ' \ \.Ju ,)l,)ld IUOJ ,)41 :iuIJO\1I,;) \f\JO)JJ rur \IOJluo:)
I>-L L'U UI,)l\.\" .U 0 1U.1\ U1)0 ,)Juru,)llIlfl
0\ L'U iusumoop P,u1Jo4)nr ,\ I,)l r IJd ru d d r .\l.t p,)lJoJdn\
pur pllr.\ ,)Jr UOUp,,)J) 01 \1U,)UI.,)Unq\lp 1l'41 ,)In\u.l OJ \IOJllm:)
<: -0 lUnOJJr IOJllIUJ J,.1~p,)l rJ')u ~
J41 01 J:&ip,)I ~'1n\ Jlqr.\rd \tuno)Jr J41 JU uourl(lJUOJJJ JlpoIJJ.1 bL
I> OJ 1U"lUl.\rd JOJ p"lllJ041nr .\ p oldOJd ,ur pur 'u()(bJ :'IUI.\I.l),)J
01 pJ4JlrUl JJr \uol1lunhJJ ~r4,)Jnd 1r41 JJn\u,) 01 '1<U1l1O:) L
L 0' \J,.1llddn\ 01 \1lI,)lII.\rd pur U\r'pJnd)o ~UlJ O ')J )0 'UUlPllIU pur
,U lr llt. \ .u r J n ) J r "\.Ju,)l,,lldliloJ ,)41 oUmu,) 01 \rJUJ,)J pUf 'I(U1U0:J u:
t- <:-0 UJ.JI\.\\ .l\l'lpJnd pur ,)Iqr.ird \1lIno))r )0 "Juru,)IlJlfl '1L
nJ P,)P.l.JJX.l lOU oUr UI11I1I"p.lJJ Ir41 pur \..lIn up.,)J) Jl~1
p.1.\oJddr .lJr u.JlUo)\nJ .\ 4 u n ..\ IIp.,lJ) .\1110 )r41 :iUIJm.U.l 'IUJ1lIU:1 SL
b ro \j10 .lItH\ lQ'>l' prq JO
uourZIJ041nr rur :iUlJUU).1J Joldwd ,)In\u.l 01 .,)Jl'ld In ~np.,)(u1
nJ :'IulNI r.,):'Ir JJqr,\I.JJJJ \lunO).lr
ul')o uOlll'JrdJJd Jll'llll.)r) 01 \..lIn JU ~UI1 J41 UO uonnUJo)1I1 rz
L nl umcooe IOJIUO) u:'IpJllrJ"lII.J)f J41
0) J,)~pJI-qn\ ,)Jqr.\I,)J.lJ uunOJ.)r '>41)0 uOl1rlllJuoJ,JJ .llpolJ'>cl ZL
L 1-0 ,1lI,JUI.\rd J.>tlJOI\nJ pur \.,lIn UpJJ))O ~U1l JO J
JO \WUlI.,lUII1 pur .( Jlp llf.\ '.\JfJnJJr '\\..,)UJIJldtlJo.> ,)41 .lJn,u,J 01
IOUUOJ UI,)I\.,\\ ""In rUf ,)Jqf.\I.>J.lJ 'mno.»r)o .,)JUfU.JIUlr" IL
II nl .lJqr.\IJ').lJ JU .J1<tdrd \JUno.l.lr
P"l)fl.lJ "41)0 JU"ltll.lIU.l\)O "lJrJ' .141 Ir pur ,)1'" JO ~r4)Jnd
.In airp ,)4) Ir II10ll IJ.llF' UI \.,llrJ J:'Iur4.lx.> JO uotlr.l!JIIU'>PI OL
II ro uOIlr1u.>tlJnJOp :iUIUlltldl1\ .llrlJJmJdr
.\q r,)uoddO\ \1 uOlunuru Ipr,) 1f41 .lJl1\U.l 01 'lon10 ~> 6 CJ
b nl \lIJno.)Jr J41 111 IIJJunr.liJI
J.>dOJd .l.\I,)JJJ \UOIDnUru pJpJO)JJ ~U1Jn\u,) \'~pJI :>

II \ '0 \lUJUI,)lfl\ ,ur<t

01 \luno,)Jr IOJ1UOJ JJ:'lpJI IrJ,)u,):,4 )0 uOl1rIIIJUo,)JJ JlpolJJcl L9
L 1'0 1U,)tlI..l\Jnq\IP pur \ldl.l,)JJ 4,r.> .10 :'IUI('JO,).>J IrUlUlJo '\.,)lIIpmu
pur .\) Ip llr.\ '.urJn»r '\~UJI ldU O') .,lltl :'IUlJlhUJ \1<01110:> <)<}

«t: ro UI.JI\ .\\ \JUJUI\JI'kl'IP rur \IJI,)J.lJ 4\rJ .10 .lJu,)J\IX3 59

II ( '0 rllr.\ rur ,)lrJnJ.>r ',)I,)ld Ill O) "lJr 'JUno,).lr
,)41 01 \uollrJOllr Ir41 JJI1\UJ 01 \llUIUO:)
II CII r: .)1,) 'P.l.\Oldlll.,) Inldr.> '\Jnoll Jt1l~f l). JIP " :4<J) \luno .l..lr
J41 UI \I\()J )0 \uonrJ0llr J~I ,I\r<t r.>u~J.>p .\ p lr u J ruJ d v f9
L rn UOlntJ~I

)0 :4I11UoJJJ pur ~UlJ O').lJ :'Iunr111IJrJ \mnoJ.)r)o u r 4 ~> L1J

9'L <: '0 111,)1\.\\ :'I1IIIUnoJJr I\()J .10 .JJuru,)llIlrl 1'1
II rn r,)Ulr1Ulr11l UJ11J,),) IU.,lUn\.J.\UI
JO I~OJ pur '.u lll<tI\ UIk! \..lJ ' 1\0.1 ."1 \PJO.lJll 1)'1
L rll P'>(1JO.l..lJ pur pJtll1ll')pl
mno))r IrJ.l.\.>\ :iunJJllr \II01J.)nuru \luno,)J\I 65
II I -II (J.>qUIn U inuJ ' J lrp ',):'Ird 'JUlrll 1t'IIJIlOr
":'I '.J) .lNrUl1u,)PI \.,)iJJno\ ~un\lk! J.):'Ip,)l rJ.)I ' ~)

II rn IUnOJ,)r ,;)41 UI ,\ J IU,;) J41 IJodJI1\ Iplll '\\ ,mJuln.l0p .,)Jjno\

,)lqrJllddr J41 01 J'.lJUJJJ).lJ rur r,J~ I u,Jpl ..lq ur,) UOIIJnuru
4,r.1 Ir41 J,)uurm r 4.>n~ UI fUUI"lunu .\ J IU..l 1t'1II:(IJO)O \lOOn
 sion of a large company that produces dif-
ferent medical products. The firm has
grown since its founding in 1897 in New
York. The company's major focus is its
well-known research program in com-
mercial application of audio-medical
research products. The firm, based in New
Jersey with divisions in Europe, first
became well-known for developments of
traditional medical products. Now, it
competes in two sectors: medical and
diagnosis with combined sales of $2 bil-
lion a year. The firm has 80 production
units spread all over the world with
22 000 employees. Its customers include
hospitals, laboratories, research centres,
doctors, etc. Its information system is
highly decentralized with AS/400 computers,
MIS staff, and applications based at each
country. Consolidations and especially
financial consolidations are performed at
the headquarter level.
Figure 5 shows the different audit tests
that INFAUDITOR suggests to realize in
auditing this firm FAIS. These tests of
control are described in the column
"node description". Each terminal node
may require one or several audit tests. For
example, the test General Opinion con-
sists of a sample survey conducted among
the FAIS information system users to
measure their satisfaction. The answers are
first aggregated, then converted by the
human expert to grades reported in the
column "Node grade". Column "Node
weight" indicates the importance given to
each node of the audit tree. Column
"Node Number" represents the number
of a terminal node in the audit tree.
Column "Node description" represents
domains andlor elementary domains to
be audited. It is not the purpose of
INFAUDITOR to evaluate the capability
of the firm to develop the domain, but to
evaluate whether the information system
provides relevant and timely information
for the domain.
The accounting and finance function
is a vital activity for any company.
However, without a relevant and timely
information supplied by an information
Computer Audit Update· October 1997
© 1997, $17.00 Elsevier Science Ltd.
•
system, no accounting and finance opera-
tion can be launched and sustained. In
broad terms, the FAIS consists of nine
domains. Their weights and evaluations
are listed below for the considered com-
pany.
As it can be seen, users' general opin-
ion about the information system is quite
good (7/10). The information system is
not performing well since it does not pro-
vide timely and relevant information for
the strategic plan. The situation is similar
for the tactical plan and management
control activities. Decision support system
is not considered as being a strong feature
of the company's FAIS.
The transaction recording is fairly ade-
quate and allows the firm to maintain an
information system for cost accounting
including a performant cash receipts and
disbursements. The firm maintains an effi-
cient information system for accounts
payable and purchases. Finally, this infor-
mation system performs efficient controls
ensuring the completeness, the accuracy
and the validity of fixed acquisition.The
overall evaluation is equal to 7/10.
Therefore, the company's FAIS can be
considered as performing adequately. This
is due to the large contribution of the
transaction recording system and the data
management system. However, improve-
ments can be brought to the strategic and
tactical planning information systems.
4 Conclusion & Further
Research
Expert systems can be considered as a dis-
cipline especially relevant to financial and
accounting information systems auditing.
The review of the literature points to
INFAUDITOR strengths as a tool for
management information systems audit-
ing. This article has sought to provide a
framework to Finance and Accounting
Information System auditing. Key con-
ceptual audit and measurements issues
have been addressed. The intent has been
to better equip Information System prac-
titioners to perform audit operations in
the area of information system especially
in Finance and Accounting Information
System. The main advantages of INFAU-
DITOR as an audit tool are:
It covers all the aspects of CIS,
especially Finance and Accounting
Information System auditing
It helps to determine, in a given audit
situation, the respective importance
that should be given to the tests of
control
It structures the audit domain and tests
of control as a hierarchical tree
It provides an integrated support for
all aspects of CIS auditing, and in
particular for FAIS auditing.
Although much is now well-known in
information systems auditing, much more
remains to be learned. An argument may
be made that information systems audit-
ing discipline is not yet well established.
Valuable work remains to be carried out
in this area which will include:
Calibration of the general audit tree
for different activity sectors depending
on the enterprise size
Adaptation of INFAUDITOR in the
learning process, thus focusing on the
explanation capability of the system
(Audit Computer Aided Learning)
Extension of INFAUDITOR meth-
odology to other management domains.
Acknowledgements
This work was funded in part by the
CERESSEC (ESSEC Research Center)
and by SID Partners Co. The authors
thank N. Prat for help during INFAUDI-
TOR programming phase.
References
[Akoka et aI., 93] "INFAUDITOR: An
Expert System for Information Systems
Auditing", International Computing Congress
'93, Hyderabad, India, December 93.
[Akoka & Comyn-Wattiau, 94]"An
Expert System for Marketing Information
System Auditing", Proc. 14th Inter-
national Avignon Conference (AI'94),
Paris, June 94.
[Akoka & Comyn-Wattiau, 94] "An
Expert System for Human Resources
Information System Auditing", EXPER-
SYS-94 Conference, Houston, December
1994.
[Akoka & Comyn-Wattiau, 96] "A
Knowledge Based System for Auditing
Computer and Management Information
Systems", Expert Systems with
Applications, Vol 11 (3), pp 361-375,
1996.
[AICPA, 87] "An Introduction to
Artificial Intelligence and Expert
Systems". A management advisory ser-
vices special report prepared by the EDP
Technology Research Committee,
American Institute of Certified Public
Accountants, 1987.
[Baldwin Morgan, 94] "Evidence for a
Framework of Expert Systems Impacts on
Audit Firms", Moving Toward Expert
Systems Globally in the 21st Century, J.
Liebowitz (ed), 1994.
[Bailey et aI., 85] "TICOM and the
Analysis of Internal Controls", The
Accounting Review, 2: 186,April, 1985.
[Biggs & Selfridge, 86] "GC-X: A
Prototype Expert System for the Auditor's
Going Concern Judgement", Working
Paper, University of Connecticut,January,
1986.
[Borthick, 87] "Artificial Intelligence in
Auditing: Assumptions and Preliminary
Development". Advances in Accounting,
179-204, 1987.
[Borthick & West, 87] "Expert Systems -
A New Tool for the Professional".
Accounting Horizons 1(1)9-16, 1987.
[Braun, 83] "An Application of Expert
Systems to Study the Decision Process
Used by Analytic Reveiw Information for
Computer Audit Update· October 1997 •
© 1997, $17.00 Elsevier Science Ltd.
 Audit Decisions", Ph.D. dissertation pro-
posal, University of Illinois, 1983.
[Collier & Dixon, 95] "The Evaluation
and Audit of Management Information
Systems", Managerial Auditing Journal,
\Tol. 10,~. 7,25-32,1995.
[Dillard & Mutchler, 84] "Knowledge-
Based Expert Systems in Auditing", work-
ing paper, Ohio State University, July,
1984.
[Dillard & Mutchler, 86] "Knowledge-
Based Expert Systems for Audit Opinion
Decisions", Technical Report, submitted
to the Peat Marwick, Mitchell
Foundation, 1986.
[Dillard et al. 83] "Expert Systems for
Price Analysis: A Feasibility Study", in
Federal Acquisition Research
Symposium, Williamsburg, VA, US Air
Force, December, 1983.
[Dungan & Chandler, 83] "Analysis of
Audit Judgment Through an Expert
System", faculty working paper no. 982,
University of Illinois, November, 1983.
[Dungan & Chandler, 85] "AUDITOR: A
Microcomputer-Based Expert System to
Support Auditors in the Field", Expert
Systems, October 1985.
[Dungan, 83] "A Model of an Audit
Judgment in the Form of an Expert
System," un-published Ph.D. dissertation,
University of Illinois, 1983.
[Dungan, 85] "Development of an Expert
System in an Auditing Context", paper
presented at the Boston ORSA/TIMS
meeting, 1985.
[Egerdahl, 95] "A Risk Matrix Approach
to Data Processing Facility Audits",
Internal Auditor, June 1995.
[Engelmore & Morgan, 88] (eds.)
"Blackboard Systems", Addison-Wesley
Publishing Company, 1988.
• Computer Audit Update· October 1997
© 1997, $17.00 Elsevier Science Ltd.
•
[Faye Borthick, 86] "Audit Implications of
Information Systems", The CPA Journal,
April 1986.
[Felix & Kinney, 84] "Research in the
Auditor's Opinion Formulation Process:
State of the Art", The Accounting
Review, April 1982.
[Fisher, 84] "Information Systems
Security", Prentice-Hall, 1984.
[Hansen & Messier, 89] "Expert Systems
for Decision Support in EDP Auditing",
International Journal of Computer and
Information Sciences, 11: 357-379.
[Hansen & Messier, 85] "A Knowledge-
Based Expert System for Auditing
Advanced Computer Systems", working
paper, University of Florida, January,
1985a.
[Hansen & Messier, 85a] "Some Results
from Testing an Expert System for EDP
Auditing", paper presented at the Boston
ORSA/TIMS meeting, 1985b.
[Hansen & Messier, 85b] "A Knowledge-
based Expert System for Auditing
Advanced Computer System", European
Journal of Operational Research,
September 1986.
[Hansen & Messier, 86] "A Preliminary
Investigation of EDP-XPERT", Auditing:
A Journal of Practice and Theory, Fall,
1986.
[Huber, 90] "A Theory of the Effects of
Advanced Information Technologies on
Organizational Design, Intelligence, and
Decision Making", Academy of
Management Review 15(1) 47:1, 1990.
[Ives & Learmonth, 84] "The Information
System as a Competitive Weapon",
Communications of the ACM, Dec. 1984.
Uacob & Bailey, 89] "A Decision Process
Approach to Expert Systems in
Auditing", m "Expert Systems in
Economics, Banking and Management",
Elsevier Science Publishers B.Y. (North
Holland), 1989.
[jacob & Bailey, 91J " A Conceptual
Framework for the N etwork Approach to
Expert Systems D evelopment in
Auditing", Information Processing and
Management,Vol.27 , no. 5, 1991.
[Kelly, 84] "Experts Probl em Solving for
the Audit Planning Process" , unpublished
PhD. dissertation, University of
Pittsburgh; 1984 .
[Laudon & Laudon, 91] " M anagem ent
Information Systems: A Contemporary
Perspective" , 2nd Edition, M acMill an,
1991.
[Laudon & Turner, 89] (eds.), Information
Technology and Management Strategy,
Englewood Cliffs, N], Prentice Hall, 1989.
[McCarty, 77] " R eflections on TAX-
MAN: An Exp eriment in Artifi cial
Intelligence and Legal Reasoning" ,
H arvard Law R eview, 90:827-893, 1977 .
[M essier & H ansen , 87] " Ex pe rt System s
in Auditin g: The State of the Art" ,
Auditing: A Journal of Practice and
Theory, Fall, 1987.
[Meservy, 84] "Auditing Internal
Controls: A Computatio nal M odel of th e
Review Pro cess", unpublished disserta-
tion proposal, University of Minnesot a,
Octobe r, 1984 .
[Michaelsen , 82aJ " A Knowledge-B ased
System for Individual Income and
Transfer Tax Planning", unpublished Ph D
dissertation, University of Illinois, 1982 .
[Mich aelsen , 82b] " Applicatio n of an
Exp ert Computer System to Fede ral Tax
Planning" , ACM SLCART N ewslette r,
Octobe r, 1982.
[Mich aelsen , 84] " An Expert System for
Federal Tax Planning" , Expert Systems,
1:149-1 67,1 984 .
[Miller, 84] T he 1984 Inventor y of Expert
Systems, Madison , Ga.: SEAI.I nstitute.
[Munakata & O'Leary, 8S] " A Proto type
Bu siness Expert System : A C ase Study in
Accounting" , unpublished working paper,
University of Sou th erm California, 1985.
[Reitman, 85] " Artificial Intelligence
M eets Decision Support: AI-Based
D ecision Support Systems", unpublished
presentation, Palladian Software, 1985.
[Saaty, 91] "The analytic hierarchy
pro cess" , M cGraw H ill, New York, 1980.
Sac Report, " Infor mation Systems Audit
and Control, U S Institute of Int ernal
Audito rs R esearch Foundation,
Alto nionte Spr ings (Flor ida), 1991 .
[Sanche z & Rodrigue z, 84] " Zya nya: EDP
Au diting and Expert Systems" , Moving
Toward Expert System s Globally in the
21st Century,]. Liebowitz (ed), 1994 .
[Segura, 85] Gu idelines for Evaluating the
M anagement Information Systems of
Indu strial Entreprises, World Bank
Tech nical Paper, numb er 47, 1985.
[Silverman , 87] Expert Systems for
Bu siness, Addi son-Wesley Publishing
C ompany, 1987 .
[Steinh art , 87] " Ma teriality: A Case Study
U sing Expert Systems" , The Accounting
R eview, pp 97 116, 1987.
[Willingham & Wright, 85]
" D evelopment of a Knowledge-based
System for Auditing the Collectability of a
Comm ercial Loan" , paper presented at
th e Boston ORSA/TIMS me eting, 1985.
] Akoka
Ecole S uperieure des S ciences Economiques et
Commerciales (ESSEC) Avenue Bernard
H irsch,BP105, 95021 C E R GY-
PO NTOISEC edex (FRANCE)Emai/:
A koka@EDU ESSEC. FR
1. C omyn - Wattiau
ESSEC & Laboratoire PRiSM, Universite de
versailles, 45 av des Etats-Unis,
78035 VERSAILLES Cedex, FRANCE.
tu. 33 1 34433076.
Fax: 33 1 3 443 3 001 .
Computer Audit Updat e • October 1 9 9 7 .
© 1997, $17 .00 Elsevier Science Ltd.