A look at the future of auditing
Our experts explore the key implications of digital transformation for the audit profession, analysing how technological innovation is redefining the role of the auditor, audit processes and the skills required of professionals in the sector. By focusing on the evolution of ISA standards, the use of data analytics tools, IT controls and Automated Tools and Techniques (ATT), the report examines the opportunities offered by digitalisation to improve the effectiveness and quality of audits, whilst also addressing the new risks associated with the use of artificial intelligence and automated processes. A dedicated in-depth analysis also highlights the main challenges linked to automation bias and the governance of new technologies, offering an overview of the future prospects for the auditing profession.
Auditing in the face of digital transformation
How is digital transformation changing the role of the auditor?
Digital transformation is profoundly changing the role of the auditor, which is evolving from a function primarily focused on ex-post verification to one that is increasingly integrated into business processes. Today, it is no longer sufficient simply to validate financial information: it is necessary to understand the operational processes and technological systems that generate it. Access to structured data, advanced ERP platforms and digital tools enables more extensive, timely and in-depth analysis, transforming the very way in which the audit function is conceived. Consequently, there is a growing focus on information systems, data quality and the controls that ensure their reliability and integrity. The auditor assesses not only the results produced by the company, but also the reliability of the processes that generate them, helping to strengthen the internal control system and stakeholders’ confidence in an increasingly complex and digitalised business environment.
What opportunities does technological development offer the audit profession?
Technological development presents a significant opportunity to make auditing more effective, efficient and better aligned with the growing complexity of businesses. The use of data analytics tools and automated solutions makes it possible to analyse volumes of data that would have been unthinkable just a few years ago, broadening the scope of audits and improving the quality of audit evidence. Manual and repetitive tasks can be progressively reduced, allowing the auditor to devote greater attention to understanding risks, critically analysing evidence and gaining an insight into the business. Technology does not replace professional judgement, but rather reinforces it, enabling the auditor to make decisions based on more comprehensive and reliable information. The aim is not to carry out more checks, but to focus efforts on the areas of risk that are truly significant, offering companies an audit that is increasingly geared towards quality and value creation.
What new risks does digitalisation introduce in audited organisations?
Alongside the opportunities, digitalisation introduces new risk profiles that require an increasingly structured approach to management. Risks relating to data quality and integrity, cyber security, access management and the correct configuration of application systems are of particular significance. In highly automated environments, any errors in processes or controls can spread rapidly and have a significant impact on financial reporting. Added to this are the risks associated with the use of cloud services, dependence on technology providers and the growing interconnection between different platforms. For this reason, auditors must broaden the scope of their analysis, developing an ever-deeper understanding of the IT environment and its impact on business processes. Properly assessing technological risks today means contributing not only to the reliability of financial reporting, but also to the resilience of business processes.
How are the skills required of audit teams changing?
The skills required of audit teams are evolving towards an increasingly multidisciplinary model. Accounting, financial and regulatory knowledge remain the foundation of the profession, but must be complemented by the ability to understand information systems, data flows, automated controls and advanced analytical tools. At the same time, there is a growing need to develop a broader view of the business, capable of linking technological risks to operational and financial risks. Auditors must understand not only the results produced by systems, but also the logic behind them and the potential risks associated with them. The added value of the profession lies less and less in carrying out repetitive tasks and increasingly in the ability to form independent judgements, correctly interpret the available evidence and support stakeholders through reliable, timely and forward-looking analysis.
What impact might artificial intelligence have on the future of auditing?
Artificial intelligence is set to be one of the key drivers of change in the auditing profession over the coming years. AI-based tools will enhance the identification of anomalies, risk assessment and the analysis of large volumes of data, enabling increasingly comprehensive and timely audits. This will result in audit models that are more risk-oriented, with a growing ability to identify potentially critical situations. However, the future of auditing will not be characterised by the replacement of the auditor, but rather by an increasingly effective collaboration between technology and professional judgement. Ultimate responsibility for assessments will, in fact, remain with the auditor, who is required to ensure that innovative tools are used within controlled, transparent processes that are consistent with auditing standards. In a context of continuous innovation, the distinctive value of the profession will continue to be its ability to generate trust through independent professional judgement, based on expertise, ethics and the quality of the evidence.
The application of ISAs in digital environments: IT controls, data analytics and artificial intelligence
How does ISA Italia 315 Revised change the process of identifying and assessing risks in complex IT environments?
In 2022, ISA Italia 315 Revised, ‘Identification and assessment of the risks of material misstatement through an understanding of the entity and the context in which it operates’, was issued. It encourages auditors to gain an adequate understanding of the environment and the IT systems used by the audited entity, paying particular attention to the risk factors associated with.
The audit approach cannot be separated from a broader understanding of the internal control system adopted by the company, taking into account its ongoing evolution due to the increasing use of technology and information systems, as well as a clear definition of IT controls, as required by ISA Italia 315. The quality of audit evidence, in line with the guidance set out in ISA Italia 500, must therefore necessarily take into account the context in which such evidence is obtained and the fact that the adoption of technological solutions – even advanced ones – in business processes tends to significantly influence the weight given to certain items of audit evidence (for example, the extraction of accounting entries and/or management/accounting data in electronic formats that are potentially modifiable).
In this context, it is particularly important to have reasonable assurance that the process used to record management transactions in the general ledger operates correctly in all relevant respects.
It is therefore clear that the auditor is required to possess technical knowledge that goes beyond the traditional legal and economic framework. It is important to possess the appropriate expertise to assess the IT environment and its operation adequately, with particular attention to the underlying mechanisms of the software’s operation. Such expertise makes it possible to provide assurance regarding the proper functioning of the elements that contribute to the IT environment and to confirm the objectivity and, therefore, the accuracy of the data extracted as evidence for the development of audit procedures.
How do Automated Tools and Techniques (ATT) improve the quality of audit evidence?
A natural consequence of the technological transformation of businesses is the issue of the ‘value’ and reliability of audit evidence obtained from IT systems in the context of files whose format is, by its very nature, subject to modification. It is important to recognise that, whilst evidence obtained in digital formats enables the auditor to carry out a range of advanced quantitative and qualitative analyses, it also requires the auditor to assess the completeness and accuracy of the data as audit evidence.
This requirement acts as the link between the IT environment analysis phase and the assessment of the evidence received, and establishes a sort of axiom regarding the correlation between the reliability of the IT environment as determined by the auditor and the quality of the evidence obtained in digital format. The greater the assurance obtained by the auditor regarding the reliability of the IT environment, the higher the reliability of the data-processing procedures used to produce the audit evidence in digital format.
Technological progress and the development of advanced analytical tools, combined with new knowledge in the field of IT, enable the auditor to use Automated Tools and Techniques (“ATT”), whilst ensuring, as outlined in the preceding paragraphs, that adequate assurance has been obtained regarding the proper functioning of the IT environment which the data subject to analysis was extracted from, together with verification of the completeness and accuracy of the information used (in this regard, ISA Italia Auditing Standard 315 includes specific guidance and practical examples of the use of ATT). These tools enable the auditor to carry out analytical procedures on entire data populations, with a view to identifying and assessing the risks of error and applying statistical sampling procedures, thereby allowing for a greater depth of analysis. Assurances regarding the effective functioning of the IT environment enable the auditor to reconsider work programmes based on sample checks, to concentrate their attention on so-called outliers, and to focus more closely on any verification procedures and the relevant samples under analysis.
Which IT controls need to be assessed to ensure the completeness and accuracy of the data extracted?
In order to validate the completeness and accuracy of the data extracted from the company’s information systems, the auditor is required to carry out a structured assessment of the reliability of the IT environment and the effectiveness of the general and application-specific controls governing the generation, processing, storage and transmission of information. The ASSIREVI document highlights how the reliability of digital audit evidence is closely linked to the level of reliability of the IT system from which such evidence is extracted: the more robust the IT control framework, the greater the reliability of the audit evidence obtained.
In this context, access management controls are of primary importance, as they are designed to ensure that access to systems, applications and databases is restricted to authorised users only, in accordance with the principle of least privilege. These controls mitigate the risk of unauthorised access, improper alteration of data or fictitious accounting entries. At the same time, it is necessary to assess privileged access controls relating to IT staff, as excessive privileges may allow untraceable changes to data or application configurations.
A further area of analysis concerns change management controls, namely the controls governing changes to software, applications and system configurations. The auditor must verify that every change is formally authorised, adequately tested and correctly implemented in the production environment, in order to prevent systemic errors in data processing. Similarly, master data controls are essential, as they are designed to prevent unauthorised changes to the master data that feed into accounting and reporting processes.
Application controls and interface controls must also be examined, as they ensure the correct processing of transactions and the completeness of information flows between different systems. These controls enable the detection of omissions, duplications or alterations during data transfers. Lastly, backup and recovery controls ensure operational resilience, continuity of access to data and the ability to restore data in the event of loss or corruption. The combined assessment of these controls enables the auditor to obtain reasonable assurance as to the reliability of the datasets used in the audit procedures.
How do data analytics models influence the audit sampling required by ISA 530?
Data analytics models have a profound impact on the audit sampling governed by ISA 530, altering the traditional approach based on the selection of representative samples of transactions or balances. In a traditional context, the auditor selects a statistical or non-statistical sample on which to perform tests, accepting a sampling risk arising from the fact that not all transactions are analysed.
With the introduction of advanced data analysis tools, however, the auditor can process large amounts of information in a short space of time, in some cases analysing the entire population of transactions. Through Automated Tools and Techniques (ATT), data analytics make it possible to identify correlations, anomalous trends and outliers that could indicate significant errors or fraud. This changes the rationale behind sampling: rather than selecting only random or representative items, targeted samples are constructed based on the risk identified by preliminary analyses. Consequently, the sampling required by ISA 530 becomes more dynamic and risk-based, as the auditor’s focus shifts to transactions with anomalous characteristics or a higher probability of error. A further impact concerns the quality of audit evidence. Data analytics models enable more in-depth checks and a greater ability to identify exceptions that might not come to light using manual techniques. However, the reliability of this approach depends on the quality of the input data and the robustness of the company’s IT environment. The auditor must therefore verify the completeness, accuracy and integrity of the data extracted from the information systems, as any errors in the datasets would compromise the entire analysis
In conclusion, data analytics do not replace the sampling required by ISA 530, but transform its application: from a primarily quantitative tool to a more intelligent, selective and risk-oriented process, thereby improving the effectiveness, efficiency and quality of the audit.
How can the risk of automation bias be mitigated when using AI and automated tools in audits?
The risk of automation bias (over-reliance on automated or AI tools) is not mitigated by limiting the use of technology, but rather by combining it with appropriate expertise, professional scepticism and robust audit procedures.
We could identify a number of mitigation measures. These include:
- Maintaining the auditor’s professional scepticism. The auditor must not uncritically accept the outputs produced by automated tools or AI. Professional scepticism remains the fundamental principle of the audit process, even when data analytics, automation or artificial intelligence tools are used. ISA Italia 220 explicitly highlights the risk that over-reliance on automated tools may reduce the audit team’s critical thinking ability.
- Provide adequate training for staff. Auditors must be trained to understand how technological tools work, to verify that the software correctly performs the tasks for which it is used, to interpret the outputs correctly, and finally to make audit decisions based on their professional judgement and not solely on automated processing.
- Incorporate specialist expertise into audit teams. Teams must include IT specialists and professionals with expertise in data analytics, programming and data interpretation. The Auditing Standards expressly provide for the possibility of involving professionals specialising in the analysis of information produced by automated tools.
- Validate the quality of the data and the IT environment. Before relying on the outputs of automated tools, it is necessary to obtain reasonable assurance regarding the proper functioning of the IT environment, the completeness and accuracy of the data used, and the reliability of the digital evidence.
- Treat technology as a support rather than a substitute for professional judgement. Technology enhances the efficiency and depth of analysis, but the ultimate responsibility for judgement always rests with the auditor.
In conclusion, the most effective way to mitigate automation bias is to keep the auditor at the centre of the decision-making process. AI and automated tools should be used to support audit work, whilst professional judgement, scepticism, data quality checks and the ongoing training of auditors remain essential to ensuring that audits are reliable and comply with professional standards.
