The Dempster-Shafer Theory of Belief Functions for Managing Uncertainties: An Introduction and Fraud Risk Assessment Illustration

The main purpose of this paper is to introduce the Dempster-Shafer theory (“DS” theory) of belief functions for managing uncertainties, specifically in the auditing and information systems domains. We illustrate the use of DS theory by deriving a fraud risk assessment formula for a simplified version of a model developed by Srivastava, Mock, and Turner (2007). In our formulation, fraud risk is the normalized product of four risks: risk that management has incentives to commit fraud, risk that management has opportunities to commit fraud, risk that management has an attitude to rationalize committing fraud, and the risk that auditor’s special procedures will fail to detect fraud. We demonstrate how to use such a model to plan for a financial audit where management fraud risk is assessed to be high. In addition, we discuss whether audit planning is better served by an integrated audit/fraud risk assessment as now suggested in SAS 107 (AICPA 2006a, see also ASA 200 in AUASB 2007) or by the approach illustrated in this paper where a parallel, but separate, assessment is made of audit risk and fraud risk.