Outsourcing the Information System: Determinants, Risks, and Implications for Management Control Systems

Organizations are outsourcing traditional functions that have financial reporting implications, such as transaction processing and valuation assessments, with increasing frequency. This practice of outsourcing aspects of the information system transforms the control structure of the outsourcing company and creates new challenges for management and accountants that are not explicitly addressed by current research. In this paper we synthesize academic literature and regulatory guidance on using third parties to perform functions with financial reporting implications (i.e., service organizations) and identify specific opportunities for future accounting research. To provide structure to our review and highlight knowledge gaps, we develop an organizing framework that links existing theories of outsourcing determinants to outsourcing risks and identifies the advantages and limitations of certain control mechanisms to mitigate such risks. Very little academic research exists on the use of service organizations, despite the rapid growth of this practice and regulators' concerns that financial reporting quality may suffer due to inappropriate management oversight and audit deficiencies. We provide insights for future research on (1) factors influencing companies' decisions to outsource the information system, (2) risks that arise when companies outsource the information system, and (3) implications for management control systems.