Alternative Form of Dempster s Rule for Binary Variables

Transcription

1 Iteratioal Joural of Itelliget Systems, Vol. 20, No. 8, August 2005, pp Alterative Form of Dempster s Rule for Biary Variables Rajedra P. Srivastava Erst & Youg Professor ad Director Erst & Youg Professor of Accoutig ad Iformatio Systems The Uiversity of Kasas, Lawrece, KS Phoe: , Fax: rsrivastava@ku.edu December

2 Alterative Form of Dempster s Rule for Biary Variables ABSTRACT This article develops a alterative form of Dempster s rule of combiatio for biary variables. This alterative form does ot oly provide a closed form formulae for efficiet computatio but also eables researchers to develop closed form aalytical formulae for assessig risks such as iformatio security risk, fraud risk, audit risk, idepedece risk, etc., ivolved i assurace services. We demostrate the usefuless of the alterative form i calculatig the overall iformatio security risk ad also i developig a aalytical model for assessig fraud risk. Key words: Dempster s rule, Biary variables, Belief Fuctios, Plausibility fuctios, Combiatio of evidece 2

3 Alterative Form of Dempster s Rule for Biary Variables Dempster s rule is the fudametal rule i Dempster-Shafer theory of belief fuctios (Shafer 1976) for combiig items of evidece pertaiig to a variable. The geeral form of Dempster s rule as preseted by Shafer (1976) is coceptually easy to uderstad but computatioally very complex to operatioalize. I particular, if oe is tryig to develop aalytical models for assessig such risks as audit risk (Srivastava et al 2004a), fraud risk (Srivastava et al 2004b), ad auditor s idepedece risk (Turer et al. 2004), the geeral form is ot of much help. I this research ote, we develop a alterative form of Dempster s rule for combiig items of evidece that pertai to a biary variable. The alterative form of Dempster s rule preseted i this article provides ot oly a closed form formula for efficiet computatio but also eables researchers to develop closed form aalytical formulae for assessig risks as metioed earlier. Such aalytical formulae are eeded, especially whe empirical evidece shows that auditors do thik of ucertaities i terms of belief fuctios as demostrated by Harriso et al. (2002). Dempster s Rule of Combiatio for Biary Variables Dempster s rule of combiatio of beliefs from two idepedet items of evidece is give by (Shafer 1976): m(a ) = m (A )m (A )/ K , (1) A=A 1 A 2 K = 1 m (A )m (A ) (2) A 1 A 2 = 3

4 where m(a) represets the combied m-value o A, m 1 ad m 2 represet the two sets of m- values 1, o the frame Θ, ad K represets the reormalizatio costat. The secod term i K represets the coflict betwee the two items of evidece. If the coflict term is 1, i.e., if the two items of evidece exactly cotradict each other, the K = 0 ad, i such a situatio, the two items of evidece are ot combiable. I other words, Dempster s rule caot be used whe K = 0. I order to derive the geeral form of Dempster s rule for a biary variable, we first cosider the above formula for two items of evidece ad the geeralize it for -items of evidece. Let us cosider a biary variable X with two values: x, that the variable X is true ad ~x that the variable is ot true. The frame of discermet, Θ, is give by Θ = {x, ~x}. Let us assume the followig m-values to represet the two set of beliefs obtaied from two idepedet items of evidece pertaiig to variable X: Evidece 1: Evidece 2: m 1 (x), m 1 (~x), ad m 1 (Θ). m 2 (x), m 2 (~x), ad m 2 (Θ). writte as: The combied m-values usig Dempster s rule give i Equatios (1) ad (2) ca be m(x) = [m 1 (x) m 2 (x) + m 1 (x) m 2 (Θ) + m 1 (Θ) m 2 (x)]/k, (3) m(~x) = [m 1 (~x) m 2 (~x) + m 1 (~x) m 2 (Θ) + m 1 (Θ) m 2 (~x)]/k, (4) m(θ) = m 1 (Θ) m 2 (Θ)/K, (5) where K is give by 1 Shafer (1976) calls these m-values as the basic probability mass assigmet fuctio whereas Smets (1990a, 1990b, 1998) calls them the basic belief mass assigmet fuctio. 4

5 K = 1 {m 1 (x) m 2 (~x) + m 1 (~x) m 2 (x)}. (6) Equatios (3) ad (4) ca be rewritte 2 as: m(x) = 1 (1 m 1 (x))(1 m 2 (x) )/K, (7) m(~x) = 1 (1 m 1 (~x))(1 m 2 (~x))/k, (8) ad the reormalizatio costat K i Equatio (5) ca be rewritte as: K = (1 m 1 (x)) (1 m 2 (x)) + (1 m 1 (~x)) (1 m 2 (~x)) m 1 (Θ) m 2 (Θ). (9) Equatios (5), (7) ad (8) give the combied m-values for biary variable, X, whe two idepedece items of evidece pertaiig to the variable are combied usig Dempster s rule. By extedig the above results from two idepedet items of evidece to idepedece items of evidece pertaiig to variable X, oe obtais m-values as give i the followig propositio: Propositio: Dempster s rule yields the followig m-values whe idepedet items of evidece pertaiig to a biary variable, X are combied: 2 Sice m(x) = [m 1 (x) m 2 (x) + m 1 (x) m 2 (Θ) + m 1 (Θ) m 2 (x)]/k, ad K = (1 m 1 (x)) (1 m 2 (x)) + (1 m 1 (~x)) (1 m 2 (~x)) m 1 (Θ) m 2 (Θ), we ca write m(x) as: m(x) = [{m 1 (x) + m 1 (Θ)}{m 2 (x) + m 2 (Θ)} m 1 (Θ)m 2 (Θ)]/K, = [{1 m 1 (~x)}{1 m 2 (~x)} m 1 (Θ)m 2 (Θ)]/K, = 1 {1 m 1 (x)}{1 m 2 (x)}/k. Similarly, we ca write m(~x) as: m(~x) = [{m 1 (~x) + m 1 (Θ)}{m 2 (~x) + m 2 (Θ)} m 1 (Θ)m 2 (Θ)]/K, = [{1 m 1 (x)}{1 m 2 (x)} m 1 (Θ)m 2 (Θ)]/K, = 1 {1 m 1 (~x)}{1 m 2 (~x)}/k. 5

6 m( x ) = 1 ( 1 m i ( x ) ) /K, (10) m(~) x = 1 ( 1 m(~)/k i x ), (11) m( Θ ) = m i ( Θ ) / K, (12) where K is give by K = ( 1 m i ( x ) ) + ( 1 m i (~ x ) ) m i ( Θ ) The plausibility fuctios ca be writte 3 as:. (13) Pl( x ) = ( 1 m i (~ x ) ) /K = Pl i ( x )/K, (14) Pl(~ x ) = ( 1 m i ( x ) ) /K = Pl i (~ x )/K. (15) The proof of the above propositio is straight forward extesio of Equatios (5), (7)-(9) through iductio. As oe ca see, Equatios (10)-(13) provide a way to ot oly compute the resultat beliefs efficietly but also help oe derive aalytical formulae for the overall beliefs i a complex situatio where the decisio maker has several idepedet items of evidece pertaiig to a biary variable. Such situatios are quite commo i the real world. For example, the auditor while coductig a fiacial audit ecouters multiple items of evidece for a give accout. The above results have bee used by Srivastava et al (2004), Turer et al (2004a, 3 By defiitio: Pl(x) = 1 Bel(~x) which yields: Pl(x) = 1 m(~x) = ( 1 m i (~ x ) ) /K = Pl i ( x )/K, where K is defied i (13). 6

7 2004b) i derivig aalytical formulae for assessig the overall audit risk 4, fraud risk ad idepedece risk i a fiacial audit. Applicatios to Busiess Decisios I this sectio we show the usefuless of the alterative form of Dempster s rule i computig the overall beliefs o a biary variable ad also show how this form makes it easy to develop aalytical formulae for assessig fraud risk. Numerical Example: Iformatio Systems Security Risk Su et al. (2004) have recetly developed a evidetial reasoig approach to assessig iformatio systems security risk. They use the Dempster-Shafer theory of belief fuctios to model the ucertaities ivolved i the evidece. We use part of their model, as depicted i Figure 1, to illustrate the value of the alterative form of Dempster s rule. As see i Figure 1, we have seve items of evidece pertaiig to the assertio Customer iformatio is protected from uauthorized iteral access ad is used i ways associated with the etity s busiess. Let us assume that we have the followig set of m-values from the seve items of evidece that the assertio is true (t), ot true (~t), or we do t kow whether it is true or ot true, {t, ~t}. Evidece 1: m 1 (t) = 0.3, m 1 (~t) = 0.1, m 1 ({t, ~t}) = 0.6. Evidece 2: m 2 (t) = 0.2, m 2 (~t) = 0.1, m 2 ({t, ~t}) = 0.7. Evidece 3: m 3 (t) = 0.3, m 3 (~t) = 0, m 3 ({t, ~t}) = Audit risk is defied as the risk that the auditor has give a clea opiio o the fiacial statemets but there is a possibility that fiacial statemets may cotai material misstatemets due to errors ad fraud. Fraud risk is the risk that fiacial statemets cotai material misstatemets due to maagemet fraud. Idepedece risk is the risk that the auditor is ot idepedet of the audit cliet while coductig the fiacial audit. 7

8 Evidece 4: m 4 (t) = 0.5, m 4 (~t) = 0.1, m 4 ({t, ~t}) = 0.4. Evidece 5: m 5 (t) = 0.6, m 5 (~t) = 0.1, m 5 ({t, ~t}) = 0.3. Evidece 6: m 6 (t) = 0.3, m 6 (~t) = 0.2, m 6 ({t, ~t}) = 0.5. Evidece 7: m 7 (t) = 0.6, m 7 (~t) = 0.1, m 7 ({t, ~t}) = 0.3. Usig the alterative form of Dempster s rule give i Propositio 1, oe ca easily obtai the combied m-values. The reormalizatio costat K for the above case is give by ( ) ( ) = 0.7x0.8x0.7x0.5x0.4x0.7x0.4 K = 1 m (t) + 1 m (~ t) m ({t,~t}) i i i + 0.9x0.9x1.0x0.9x0.9x0.8x x0.7x0.7x0.4x0.3x0.5x0.3 = , ad the m-values as: 7 m(t) = 1 ( 1 m (t) ) /K = 1 0.7x0.8x0.7x0.5x0.4x0.7x0.4/ = , 7 i m(~t) = 1 ( 1 m (~t) ) /K = 1 0.9x0.9x1.0x0.9x0.9x0.8x0.9/ = , 7 i i m({t,~t}) = m ({t,~t}) / K = 0.6x0.7x0.7x0.4x0.3x0.5x0.3/ = Thus, we ca easily determie the overall beliefs ad plausibilities that the assertio is true or ot true as give below: Bel(t) = 0.955, Bel(~t) = 0.034, Pl(t) = 1 Bel(~t) = 1 m(~t) 7 = 1 m (~t) /K = 0.966, ad ( ) i Pl(~t) = 1 Brl (t) = 1 m(t) = 7 = ( 1 m (t) ) /K = i 8

9 Plausibility that the assertio Customer iformatio is protected from uauthorized iteral access ad is used i ways associated with the etity s busiess is ot true represets the risk related to this assertio. Su et al. (2004) discuss iformatio security risk i great detail. As we ca see from the above example, the alterative form of Dempster s rule makes it very coveiet to compute the combied beliefs i oe step. I fact, oe ca easily program the logic i MS Excel Spreadsheet to compute the combied m-values for a large umber of idepedet items of evidece. Fraud Risk Srivastava et al. (2004) have developed a comprehesive aalytical model for assessig the risk of fraud i fiacial statemets usig Dempster-Shafer theory of belief fuctios. Also, Turer et al (2004) have used Dempster-Shafer theory of belief fuctios to develop a aalytical model for assessig the overall audit risk that fiacial statemets will cotai material error due to radom errors ad/or due to maagemet fraud while the auditor has give a clea opiio. I all such cases, oe eeds to combie various idepedet items of evidece pertaiig to a sigle biary variable. The alterative form of Dempster s rule becomes very useful i such situatios. Here, we cosider a much simpler example to illustrate the value of the alterative form of Dempster s rule for biary variables. The auditig literature (see, e.g., Ramos 2003) discusses that maagemet will commit fraud whe the followig three coditios exist: maagemet lacks itegrity, maagemet has icetives, ad there are opportuities to commit fraud. The auditor is required through professioal stadards (AICPA 2002) that he/she should assess the risk of maagemet fraud by assessig whether maagemet lacks itegrity, has icetives ad opportuities to commit fraud. 9

10 For simplicity, we represet this combied assessmet of the risk of fraud by oe item of evidece (RF) i Figure 2. Oce the auditor has idetified that there is a potetial for maagemet fraud the he/she evaluates the existig mitigatig factors (MF) that may be preset i the situatio ad would reduce the risk of fraud. Security ad Exchage Commissio s regulatios ad pealties to CEOs (Chief Executive Officers) for committig fraud are few examples of such mitigatig factors. Also, while performig the routie audit procedures such as, aalytical procedures (AP: ratio aalyses, compariso of the curret year accout balace with the last year accout balace ad with the idustry average, etc), test of cotrols (TC), ad test of details of the accout balace (TD), the auditor might be able to detect fraud. While these routie audit procedures are ot very effective i detectig fraud, they do detect sometimes. Thus, oe should ot attach too much weight o these items of evidece whe they pertai to No Fraud assertio. Ultimately, if the assessed risk of fraud is high the the auditor should perform foresic procedures (FP) to detect fraud. All these items of evidece are depicted i Figure 2 through rectagular boxes. They all pertai to oe assertio or variable that There is o fraud i objective O of accout A. We assume that this variable has two values, yes, fraud is preset (yf) ad o, fraud is ot preset (f). The opportuity to commit fraud ad also the type of routie audit procedures deped o the specific assertio 5 of the accout i iterest. For example, accouts receivable balace would 5 Accordig to the auditig literature (AICPA 1980), there are five maagemet assertios: Existece or Occurrece Completeess Valuatios or Allocatios Rights ad Obligatios ad Presetatios ad Disclosures. Whe maagemet publishes the fiacial statemets of the compay, they implicitly imply that the above assertios are true for all the trasactios. I other words, maagemet implies that all recorded tasactios exist or have occurred (Existece or Occurrece), all trasactios are recorded (Completeess), all trasactios are valued properly, the maagemet has the right of assets to use ad obligatio of liabilities to pay (Rights ad Obligatios), ad all relevat disclosures ad presetatios are 10

11 be overstated if maagemet created fictitious sales o credit. I order to detect this fraud, the auditor eeds to perform audit procedures that are specific to the objective Existece of accouts receivable, which implies that the accout receivable balace is ot overstated due to fictitious trasactios. Also, the type of foresic procedures performed by the auditor will deped o the ature of accout ad its objective. Usig Equatio (15), the plausibility that fraud is committed i objective O of accout A, give the evidece i Figure 2, ca be writte as: Pl(yf) = Pl RF(yf)Pl MF(yf)Pl AP (yf)pl TC(yf)Pl TD(yf)Pl FP (yf)/k, (16) where K is determied by Equatio (13), ad Pl.. (..) s o the right side represet various plausibilities that there is fraud based o the correspodig evidece labeled as the subscript. Srivastava ad Shafer (1992) argue that plausibility that error exists i the fiacial statemets is a better measure of risk. Usig their defiitio of risk, we write the followig formula for fraud risk (FR) by usig (16): Fraud Risk = FR = FR RF FR MF FR AP FR TC FR TD FR FP /K (17) The above model suggests that the overall fraud risk is the product of six fraud risks assessed by the followig evidece: 1) factors such as lack of maagemet itegrity, presece of icetives, ad presece of opportuities, 2) mitigatig factors, 3) aalytical procedures, 4) test of cotrols, 5) test of details, ad 6) foresic procedures. The above formula ca be used to determie the made (Presetatios ad Disclosures). We will use the term Objective i place of Assertio i this article. 11

12 overall fraud risk by assessig the idividual compoets. The simple form of the fraud risk formula as give i (17) is possible oly because of the alterative form of Dempster s rule. Coclusio We have derived a alterative form of Dempster s rule of combiatio of evidece for biary variables. This form allows oe to compute the combied m-values more efficietly ad also allows oe to develop aalytical formulae for real world problems such as audit risk, fraud risk, idepedece risk, ad etc. Such closed form aalytical formulae are eeded for assessig the above risks durig a audit/assurace egagemet. 12

13 Refereces America Istitute of Certified Public Accoutats (AICPA) Cosideratio of Fraud i a Fiacial Statemet Audit. SAS No. 99. New York, NY: AICPA. America Istitute of Certified Public Accoutats Statemet o Auditig Stadards, No, 31: Evidetial Matter, New York: AICPA. Harriso, K., R. P. Srivastava, ad R. D. Plumlee Auditors Evaluatios of Ucertai Audit Evidece: Belief Fuctios versus Probabilities. I Belief Fuctios i Busiess Decisios, edited by R. P. Srivastava ad T. Mock, Physica-Verlag, Heidelberg, Spriger-Verlag Compay: Ramos, M Auditors Resposibility for Fraud Detectio. Joural of Accoutacy, May: Shafer, G A Mathematical Theory of Evidece. Priceto Uiversity Press. Smets, P. 1990a. The Combiatio of Evidece i the Trasferable Belief Model. IEEE Trasactios o Patter Aalysis ad Machie Itelligece, 12, 5 (May). Smets, P. 1990b. Costructig the Pigistic Probability Fuctio i a Cotext of Ucertaity. Ucertaity i Artificial Itelligece 5. ed. by Herio, M., Shachter, R.D., Kaal, L.N., ad Lemmer, J.F. North-Hollad: Elsevier Sciece Publishers B.V. Smets, P The Trasferable Belief Model For Quatified Belief Represetatio. Quatified Represetatio for Ucertaity ad Imprecisio, Vol. 1. Edited by P. Smets. Kluwer Academic Publishers Srivastava, R. P., ad G. Shafer Belief-Fuctio Formulas for Audit Risk. The Accoutig Review, April: Srivastava, R. P., T. Mock, ad J. Turer The Effects of Itegrity, Opportuity, Icetive ad Mitigatig Factors o Fraud Risk. Workig paper, Uiversity of Kasas. Su, L., R. P. Srivastava, ad T. Mock A Iformatio Systems Security Risk Assessmet Model uder Dempster-Shafer Theory of Belief Fuctios. Workig Paper, School of Busiess, The Uiversity of Kasas. Turer, J., R. P. Srivastava, ad, T. Mock. 2004a. Itegratig Fraud Risk ito the Audit Risk Model: The Evolutio of Audit Risk. Workig paper, Uiversity of Kasas. Turer, J., T. Mock, ad R. P. Srivastava. 2004b. A Aalysis of the Auditors Idepedece: Effects of Icetive, Opportuity, ad Ratioalizatio. Workig paper, Uiversity of Kasas. 13

14 Figure 1: Seve Items of Evidece pertaiig to oe Assertio E1: Policies are set for ways to use customer iformatio. E2: Oly a small umber of operatios staff has access rights to the database. E3: All requests for data are chaeled through a DBA who the requests from operatio staff. Customer iformatio is protected from uauthorized iteral access ad is used i ways associated with the etity s busiess. E4: Staff ca ot directly access the uderlyig SQL DB that stores customer iformatio. E5: Policy restricts the staff from disclosig private customer iformatio to ay third party. E6: Clearly states o the web that ABC ca give access to customers private data to other divisios. E7: Policies ad moitorig procedures to esure oly certai employees ca access to customer iformatio. 14

15 Figure 2: Fraud Risk Assessmet* RF: Maagemet Lacks Itegrity, has Icetives ad Opportuities to Commit fraud. MF: Mitigatig Factors Pertaiig to Opportuities to Commit Fraud related to objective O of accout A. No Fraud Related to Objective O of Accout A {f, yf } AP: Aalytical Procedures related to Objective O of Accout A. TC: Test of Cotrols pertaiig to objective O of accout A. FP: Foresic Procedures to detect presece of fraud i Objective O of Accout A. TD: Test of Details pertaiig to Objective O of Accout A. *The oval shape box represets the assertio or the variable ad the rectagular boxes represet items of evidece. 15