Discussant’s comments -

1. Symposium 2011 Discussant’s comments - Model-based Auditing Using REA Hans Weigand & Philip Elsas Eckhardt Kriel CA (SA)

2. MOTIVATION - JUSTIFICATION MOTIVATION - JUSTIFICATION I found this paper to be interesting and a topical paper. It is well researched, documented and while I agree broadly with the paper and its conclusions, I believe it makes several broad statements that require more detailed discussion and examples that link the model-based approach to these assertions and its implied solution. On a first read I got the impression that the motivation behind the papers was driven by the notion that i) there is something wrong with current external audits, ii) the audit process needs to be improved and iii) the model-based REA approach is a viable option. In the Abstract, for example, the authors state that “the recent financial crisis has underlined the urgency to improve the added value of the auditing profession”. I would like to understand what the authors mean by added-value. Where, in their opinion, do current audit reports and audit methodologies fall short of providing shareholders and other stakeholders with the knowledge they need? Is it a problem with the opinion statement - “fairly present”? Should the audit report contain a statement as to the existence of fraud or be more explicit as to the viability of the assumptions made by management for going concern?

3. MOTIVATION - JUSTIFICATION MOTIVATION - JUSTIFICATION Another statement refers to the relevancy of an audit. The opening sentence states: “The financial crisis has thrown doubts on the relevancy of the auditing profession.” Similarly I’d like a further explanation of this issue as it might guide the reader in what particular area the model-based approached will solve this problem. The financial crisis in 2008 has been extensively analyzed and it is clear that there were numerous factors in play from many different people and organizations. At the end of reading the paper I wasn’t convinced quite how the model-based approach would have played a role that might have had a different outcome.

4. MOTIVATION - JUSTIFICATION MOTIVATION - JUSTIFICATION In Chapter 2 the paper discusses auditing theory and in section 2.3 gives an overview of model-based auditing. In these paragraphs the authors state that in order for business processes to operate correctly (i.e., to be fraud resistant) internal controls and auditing processes should be built into their design and not added to. Then they should be tested to ensure they do not allow abuse or illicit behaviour. I found it difficult to distinguish why this is unique to model-based auditing as in my experience, this is a fundamental requirement of good systems design.

5. Theoretical support for the article Theoretical support for the article The authors provide documented scholarly evidence to support the content of the paper. I find however that the examples are very simplistic and perhaps don’t truly reflect the complexity of modern commercial processes. Hence it was difficult for me to see how the model-based auditing approach would actually result in a better audit. Here I mean better in the sense of lowering audit risk, being more effective and more efficient. The current auditing approach adopted by external auditors is a risk-based approach where significant accounts are identified, the business processes supporting those accounts are analyzed, risks are identified and controls that mitigate the risks are identified and tested. The auditor may also use substantive tests of balances and transactions in certain key areas. In this audit process auditors use concepts like materiality, sampling and confidence levels in arriving at their conclusions. This results in many transactions that are not scrutinised. Its is not clear to me whether the concepts of materiality, confidence levels, reasonable assurance and sampling will still be present in the model-based REA audit approach.

6. Research method employed Research method employed The author's method is based on a review of academic literature and a detailed discussion of the model-based approach with fairly simple examples. There are no surveys or case studies. I’d like to see the authors take a couple of well known fraud types - a financial statement type fraud (e.g., fictitious revenues) and an asset misappropriation fraud (e.g., fictitious supplier payments or sales kickback schemes) and show how the model-based approach might be better at detecting these than the current audit model. Another limitation I see is that the study does not address the time (cost) requirements to apply the model and it does not assess these costs against the benefits of applying the model (compared to the current approach). Clearly, the more complex the scenario, the greater the potential value (but also the cost of applying it). Overall the materials are well put together and flow logically. I believe the authors could enhance the readability of the material by running a focus group with students on the case studies and incorporating their feedback to enhance the flow and understandability of the case study.

7. Possible Example - Revenue Recognition Possible Example - Revenue Recognition MICROSTRATEGY – Application of REA Approach

8. Study Conclusions Study Conclusions The authors conclude with a summary of how the REA approach allows the audit to meet certain requirements and auditing principles and several areas where more research is needed. The paper is interesting and well worth moving forward. I think when some of my comments are addressed it will provide a more compelling view of a viable alternative.

9. Questions Eckhardt Kriel CA (SA) E Kriel & Associates Inc.1148 Forest Trail Place Oakville ON L6M 3H7 www.krielassoc.com www.d3cifer.com Mobile: +1. 416 451-3919 Direct:   +1. 416 451-3919 Email: ekriel@cogeco.ca