Professional scepticism is a critical component of an internal auditor's duty of care that applies throughout any engagement. It's an attitude that includes a questioning mind and a critical assessment of the appropriateness and sufficiency of audit evidence. It requires being alert to conditions that may indicate possible misstatement due to error, neglect or fraud, and a critical assessment of audit evidence.
Professional care, which is closely linked to professional scepticism, is critical during the planning, performance, and while preparing the report for every engagement. Auditors use their knowledge, skills, and abilities to diligently perform, in good faith and with integrity, the gathering and objective evaluation of evidence.
The scandals at Enron, WorldCom, Tyco, Stanford International Bank, many of the dealings that caused the 2008 financial collapse, and the more recent issues affecting Mitsubishi Materials, Kobe Steel, Wells Fargo, Theranos, and Volkswagen, among others, have raised questions about whether auditors and inspectors have been sufficiently sceptical in their work. The concerns of the public, some regulators, and other stakeholders have been highlighted in the media and continue to feed that debate.
Professional scepticism is fundamental to the role and performance of internal auditors, and it is a crucial aspect of audit quality. It has three elements:
1. Attributes: This refers to the knowledge, skill and overall ability of the auditor. Internal auditors must possess the knowledge, skills, and other competencies needed to perform their responsibilities.
2. Mindset: This relates to the integrity and good faith of the auditor who does not assume honesty or dishonesty on the part of the audit client, but also recognizes the possibility of fraud, misstatement or misrepresentation of essential facts. Although internal auditors can generally assume that management and employees are honest, these same auditors should not be satisfied with less than persuasive evidence.
3. Action: This element refers to the importance of performing a robust risk assessment, planning the engagement based on the risks involved, ensuring vigorous engagement supervision, and the diligent gathering and evaluation of audit evidence.
Internal auditing best practices make it clear that objectivity and professional scepticism are a crucial attribute of the capabilities of internal audit firms and their staff. This is also essential when applying the requisite judgment in selecting the audit procedures, choosing the sampling (or 100 percent testing) methodology, evaluating results, formulating conclusions, and the overall conduct of the audit work.
Among the auditable areas and topics that require internal auditor scepticism are:
• Gaining an understanding of the methods and assumptions used to determine fair value estimates for assets and financial instruments.
• Evaluating the procedures over asset impairment, work in progress, and percentage of completion calculations.
• Examining variance and sensitivity analyses.
• Reviewing management assumptions for calculating inventory reserves.
• Reviewing production figures and system-generated reports.
These procedures require more robust procedures than mere inquiry, such as careful corroboration through document inspection, mathematical analysis, observation, and recalculation.
While planning and conducting fieldwork, internal auditors should perform procedures and conduct testing commensurate with the related risks and key controls, instead of making their decision based on evidence that is easier to obtain. The focus should be on the evidence that is more relevant and reliable, getting enough of it (i.e., sufficiency) and use corroborating information rather than merely using, or giving undue weight to confirming evidence.
Although internal auditors are reminded to foster a positive relationship with their clients, they should not allow the fear of conflicts with management, the desire for high post-audit satisfaction ratings, or maintaining a long-term audit client to cloud their thinking. Neither should deadlines, the desire to keep audit costs low or pressure to remain within budget limit the rigor of their work.
Third party internal audit service providers should also follow rigorous testing procedures based on the circumstances, even though they may desire to cross-sell, or up-sell services to their audit clients.
Internal audit managers should encourage the audit team to confidently, yet professionally, challenge management representations, and be actively involved in planning, directing, and reviewing the work of the audit team. Since most internal audit managers have many years of experience, this expertise, experience, and general knowledge should be leveraged during the planning, fieldwork, and reporting phases.
Since professional scepticism is a critical component of effective internal audits and an essential ingredient of audit quality, internal auditors should verify through appropriate audit procedures the veracity of the information provided and examined. Proper care is always required and neither time and cost constraints, or familiarity with the client, should reduce the degree of scepticism applied. Internal auditors should always remain vigilant.