Auditing and Management Control Systems in the Age of Big Data

The explosion of the so-called enterprise data ecosystem has been in-tense during the last decade and it is increasing at seemingly endless pace. In the “digitization” or “datafication” era, companies worldwide must con-front with the availability of unprecedent amounts of high-velocity, high-variety of complex data retrievable from both internal, and mostly external sources, combined with unimaginable opportunities to process that data with advanced analytics solutions. This trend, that has been labelled as the advent of Big Data (BD) and Data Analytics (DA) is commonly considered as the new frontier of business and social science. Companies are thus required to face the need for a substantive innova-tion of the way in which business is conducted, decisions are made and controls, whether internal and external, are performed. BD and the related DA techniques, indeed, have been identified as the 21st century drivers of a sustainable long-term advantage. At the same time, organizations that de-cide to invest in such advanced technology, must also be aware of its dis-tinctive challenges and risks. The first section aims at exploring what are the main opportunities BD determines in business context with specific reference to decision-making and control processes. It has been pointed out, however, that most of the studies (both theoretical and empirical) has been developed by adopting an optimistic (perhaps too optimistic) view of the contribution of BD in con-ducting and controlling business. With the aim to contribute in counterbal-ance this optimistic perspective, an analysis will be proposed focused on the main threats that advanced technologies may pose to organizations’ In-formation and Management Control Systems. The second section is devoted to the analysis of the state of the art on BD and DA utilization with a focus on the Internal Audit profession in the Italian context. On the one hand, indeed, the Internal Audit Function (IAF) benefits from a privileged access to company’s processes and accounting data, that provide it with the opportunity to identify errors, inefficiencies, anomalies, frauds, and non-compliance issues. On the other, the IAF itself can benefit from the adoption of advanced technologies in order to improve of the efficiency, the effectiveness, and the level of assurance the IAF pro-vides to its main stakeholders. Basing on latest in the series of surveys of members of the Institute of Internal Auditors (IIA), known as the Common Body of Knowledge (CBOK, 2015), the objective of this section is to give an overview of the state of play in the use of BD and DA by internal audi-tors in the Italian context. The third section analyses whether and to what extent external auditors in the Italian context use BD and DA in order to perform their audit activi-ties. In recent times academics, practitioners, and representatives of the standard setting bodies have initiated an intense debate on the potential that BD and the related DA technologies may provide to statutory audit. Basing on the interviews conducted with several external auditors operating in Ita-ly, coming from both Big Four and non-Big Four audit firm, this section aims at shedding light on the how profession is positioned within the BD debate. Moreover, it explores what are the perceptions of the professionals about the main elements that may favour or hamper the opportunity to adopt such technologies within the audit engagements. Finally, respondents were asked on how the adoption of BD technology has impacted, or is ex-pected to impact, on the audit firms from an organizational standpoint. The conclusive section emphasizes that it is clear that the BD and DA phenomenon is not just a fad, but rather a reality that companies, as well as auditors, must adequately face in order to benefit from the large opportuni-ty it gives in improving decision-making, performance measurement, as well as audit activities. Companies and auditors must also be aware of the distinctive challenges brought by BD and DA in terms of data quality, and be prepared to adequately manage such challenges, capable of eroding most of its value creation potential.