Integrating natural language processing and social network analysis for risk-based auditing in public banks: A case study from Türkiye

Effective risk assessment is a critical component of internal auditing in public banks, where conventional methods often struggle to prioritize audit areas from large volumes of unstructured data. This study introduces a multi-stage Natural Language Processing (NLP) and Social Network Analysis (SNA) integrated Decision Support System (DSS) framework to enhance the targeting of audit planning. By reconceptualizing unstructured stakeholder narratives as active control inputs, the proposed framework formalizes the construct of dynamic control documents to capture structural risk patterns that traditional sampling might overlook. Applied to unstructured complaint data from three major public banks in Türkiye, findings reveal that while primary complaint themes vary across institutions—ranging from credit-related issues to card grievances—network-based analysis identifies common systemic interconnections, particularly regarding refund processes. By revealing potential risk indicators and their interconnections, this DSS framework serves as a robust risk-prioritization tool that assists auditors in identifying high-risk scoping areas. The study contributes to the information systems and auditing literature by establishing a theory-grounded mechanism for text-based risk topology mapping in public sector governance. For practitioners, the framework functions as a decision-support mechanism that may assist in audit prioritization and risk scoping through data-informed oversight. Overall, the findings demonstrate that transitioning from descriptive observations to structural risk mapping enables internal audit functions to be more proactive and strategic in an evolving risk landscape.