| The main purpose of this dissertation is to develop and improve audit/assurance risk assessment models, specifically related to going concern judgment and information systems security domain. The dissertation is divided into three parts. Each part is an individual essay.; Part 1 proposes and demonstrates an alternative methodology for the risk analysis of information systems security (ISS), an evidential reasoning approach under the Dempster-Shafer theory of belief functions. The evidential reasoning approach provides a structured framework to incorporate the complexity of risks from multiple IS assets, multiple vulnerabilities to threats, multiple controls pertaining to a single type of threat, each providing different levels of help in protecting an asset from the threat. The dissertation elaborates the theoretical concepts of the proposed method, and provides the operational guidance for implementing the method. A case study and sensitivity analyses are performed to provide useful insights and guidance to potential model users.; Part 2 reevaluates the relative performance of auditors' going concern opinions and statistical models in predicting bankruptcy. This research proposes to improve an existing statistical model (Hopwood et al. 1994) by incorporating some non-financial-accounting factors and employing a better criterion of defining stress. The results suggest that, contingent upon the specific statistical model and the specific cost ratio used for the comparison, auditors' going concern opinions can be superior to, indifferent to, or inferior to statistical models.; Part 3 provides operational guidance for using naive Bayesian networks (BNs) in bankruptcy prediction. First, the study suggests a heuristic method that guides the selection of bankruptcy predictors from a pool of potential variables. The method is based upon the assumption that the joint distribution of the variables is multivariate normal. A naive BN model is developed using the proposed heuristic method and is found to perform well in a ten-fold analysis. Second, the study analyzes whether the number of states into which continuous variables are discretized has an impact on a naive BN's performance. Finally, the study suggests that modeling continuous variables with continuous distributions instead of discretizing them does not improve the naive BN model's performance. |
