Crucial to an internal auditor’s ability to complete any audit successfully is his or her ability to demonstrate objectivity in both the approach to and performance of the engagement. Yet this may be the most difficult ability to develop and maintain, particularly because most internal auditors are employees of the organizations they audit. This potential for bias remains true even when organizations rely on outsourced service providers to perform internal audit responsibilities.
To provide an organization’s management and board of directors with an audit product that meets their expectations for quality, internal auditors must be able to exercise professional judgment free from the interference that can sometimes result from their employee — or service provider — relationship with the organization. Professional skepticism is a key element of objectivity. Like most skills auditors should seek to cultivate, the ability to approach each audit engagement with the appropriate degree of professional skepticism must be intentionally nurtured through education and practice.
Viewpoints on Skepticism
Standard 1100: Independence and Objectivity of The IIA’s
International Standards for the Professional Practice of Internal Auditing (Standards) refers to objectivity as “an unbiased mental attitude” that “requires that internal auditors do not subordinate their judgment on audit matters to others.” Sawyer’s Guide for Internal Auditors, 6th edition, echoes this definition by stating that objectivity “is the impartial, unbiased attitude that all internal auditors must have in performing their work.” Yet maintaining such an attitude, while performing engagement responsibilities effectively, is no easy task, and it depends on the development of numerous related skills such as critical thinking, self-evaluation, and interpersonal communication.
The definitions in the
Standards and Sawyer’s view professional skepticism as being neutral with regard to an individual’s approach to auditing. In this view the internal auditor neither assumes that management is dishonest nor assumes unquestioned honesty — he or she simply has a questioning mind and critically assesses audit evidence. This “neutrality” view of professional skepticism anticipates that auditors are able to separate themselves from those external and internal biases that could negatively affect their ability to evaluate the audit evidence objectively. However, this view often leaves unanswered questions about how auditors can determine when they have effectively exercised skepticism in their audit approach or how to measure the possible effect on the evaluation of audit evidence whenever they have not.
On the other hand, standards that focus on fraud, such as U.S. Public Company Accounting Oversight Board standard AU Section 316A, Consideration of Fraud in a Financial Statement Audit, take a forensic-audit view of professional skepticism in which auditors have an attitude of “presumptive doubt” and assume some level of dishonesty by management, unless the evidence indicates otherwise. For internal auditors, such an approach may be applicable when considering the possibility of fraud in all types of audits.
Under a presumptive doubt view, auditors possessing a high level of professional skepticism are more likely to doubt the sufficiency of evidence that would normally be viewed as appropriately supporting the audit objective. Such auditors will tend to collect more evidence, which may result in a less efficient audit.
As reliance on the work of internal audit by external parties grows, internal auditors should note that regulators appear to take the presumptive doubt perspective of professional skepticism. Regulators typically cite professional skepticism as a missing ingredient in the auditor’s objectivity whenever an external audit failure has occurred. The U.S. Securities and Exchange Commission often has identified a lack of professional skepticism as a primary contributing factor to the circumstances involved in enforcement cases, as well as in malpractice claims against external auditors.
Likewise, law enforcement agencies tend to refer to external audit standards in fraud cases. With this in mind, internal auditors should be prepared to address, or defend, their level of objectivity in completing an audit that is to be relied on by others or that is the basis of an external investigation. To do so, internal auditors must be able to understand, identify, and approach such engagements with an appropriate level of skepticism.
A Skepticism Continuum
Professors Stephen Glover and Douglas Prawitt of Brigham Young University propose a different view on the exercise of professional skepticism in a 2013 publication from the Center for Audit Quality’s Global Public Policy Committee, which comprises the six largest public accounting firms. In Enhancing Auditor Professional Skepticism, they advise auditors to approach each engagement using a “professional skepticism continuum” where the appropriate level of skepticism depends on the risk characteristics of the area under audit.
On this continuum, the level of professional skepticism moves from something less than complete trust, to a neutral mind-set, to presumptive doubt, and all the way to complete doubt. The appropriate level of skepticism to apply is initially determined only after a careful and rigorous risk assessment. However, Glover and Prawitt stress that to ensure an appropriate level of professional skepticism is consistently applied to collecting and evaluating all audit evidence, the auditor should continue to reevaluate that initial determination throughout the engagement.
In using the continuum approach, less persuasive evidence is required for those instances where no fraud indicators exist, no errors are detected, routine processes requiring little judgment are examined, and the audit evidence is consistent with the initial risk assessment, regardless of the area of risk being audited. Likewise, less persuasive evidence would be required for those assertions of lower risk. This frees auditors to focus the bulk of their efforts on high-risk areas where there logically should be greater doubt.
|Divergence and Convergence|
Professors David Plumlee and Brett Rixom of the University of Utah, and Andrew Rosman of the University of Connecticut, view professional skepticism not as a trait or mind-set, but rather as a diagnostic-reasoning process that is found in the problem-identification and structuring phases of creative problem-solving. In a 2011 study funded by the Center for Audit Quality, the researchers found that providing online training to senior auditors that taught them to reason diagnostically improved their ability to be professionally skeptical. Specifically, the auditors were given less than persuasive evidence and were asked to use divergent thinking followed by convergent thinking when evaluating the evidence.
Divergent thinking requires auditors to generate explanations for evidence or circumstances they identify as unusual without a concerted effort to ensure that each explanation is logically valid. Once they have produced a complete set of explanations, auditors use convergent thinking to systematically assess the plausibility of each of them. Plumlee and his colleagues found that divergent thinking training increased both the number and quality of explanations generated for an unusual situation. In addition, those senior auditors trained in both divergent and convergent thinking were more likely to generate and ultimately choose the correct explanation compared to those who did not receive the full training.
The researchers hypothesized that the typical mode of generating explanations involves a continuous examination of possible explanations known as “consistency checking.” Moreover, they posited that auditors who were trained to apply a sequence of divergent thinking followed by convergent thinking will not resort to “consistency checking.” Decision-makers spontaneously engage in consistency checking when they evaluate explanations as they occur, eliminating some based on superficial consideration. Training in both types of thinking led individuals, during the divergent phase, to consciously keep explanations they generated for later evaluation during the convergent thinking phase of the diagnostic-reasoning process.
Skepticism is both a personality trait and a state of mind. Personal traits that contribute to the auditor’s ability to exercise appropriate professional skepticism include a questioning mind, the ability to analyze and critically evaluate, problem-solving ability, ethical and moral reasoning, a willingness to suspend judgment, and a tendency to search for knowledge, according to a 2010 article by Baylor University accounting professor Kathy Hurtt, “Development of a Scale to Measure Professional Skepticism.” Three additional abilities ensure that an individual’s skeptical mind-set will translate into actions: interpersonal understanding, a sense of autonomy, and confidence based in self-esteem. Interpersonal understanding considers human biases when analyzing evidence, while autonomy and self-esteem pertain to the courage to stand up to the pressures of others and draw one’s own conclusions.
In practice, academic research has shown that audit students and practicing auditors do not differ in their overall levels of skepticism, which is consistent with the theory that skepticism is a relatively stable personality trait. Developing their creative problem-solving skills is one way auditors can increase their level of skepticism (see “Divergence and Convergence” at right).
Encouraging a skeptical mind-set may be as simple as providing fraud training or training in the appropriate use of Glover and Prawitt’s continuum. Several activities provide starting points for enhancing the professional skepticism of an internal audit team.
Improve Critical Thinking Training and other activities designed specifically to strengthen critical-thinking skills can have a positive effect on an auditor’s ability to approach audit evidence with more skepticism. There are many resources available to develop such skills.
Self-evaluate Objectivity IIA Standard 1120: Individual Objectivity calls on internal auditors to “have an impartial, unbiased attitude and avoid any conflict of interest.” One way to gauge potential conflicts of interest is to have team members identify relationships and other influences, such as friendships with associates in the area under audit, that potentially could have a negative effect on their objectivity. Audit leaders should evaluate the level in which these influences could affect auditors’ judgment, then identify ways to counter them. The IIA Research Foundation report, Behavioral Dimensions of Internal Auditing: A Practical Guide to Professional Relationships in Internal Auditing, can be helpful in evaluating professional relationships.
Involve Auditors Outside the Engagement Team When possible, internal auditors should invite a member of the audit group who is not on the current engagement team to interview an individual, if they believe their personal relationship with that person may negatively affect their ability to be appropriately skeptical. They should observe the interview as a nonparticipant, drawing their own conclusions. Afterwards, auditors should debrief the interviewer to learn his or her conclusions and compare them to their own, evaluating whether any significant differences were the result of the degree of skepticism employed.
Post-audit Peer Reviews Internal auditors should ask colleagues to review their work on a recent audit that involved a substantial degree of judgment or tested their objectivity. Such peers should challenge them to defend the type and volume of evidence accumulated during the engagement. Then auditors and their peers should evaluate whether the evidence supported the conclusions, in light of the audit objectives, and the auditors demonstrated an appropriate degree of skepticism.
Ultimately, an internal auditor’s ability to maintain objectivity through the use of professional skepticism affects his or her ability to make sound judgments. But as important as skepticism is, it is only one of the factors that influence professional judgment, alongside audit and industry expertise.
As internal auditors begin their next engagement, they should consider how their view of professional skepticism will ultimately affect their evaluation of the audit evidence. They should take time to document their thought process and its effect on that evaluation. Moreover, they should keep in mind that a competent auditor is a skeptical auditor.