Outside the box: fake views – how can we ensure that what we believe is true?

What is the truth? Is there such a thing and is it ever possible to find it? This is a worrying question for internal auditors. They are, after all, expected to find it, verify it and explain it to boards and audit committees. Are they chasing the rainbow’s end?

Recent developments in technology have moved questions about the nature of verifiable “truth” on from the days when it was the preserve of philosophers. Fake news, fake evidence, fake images and AI-generated everything risks undermining our tattered remnants of faith in data. This is a process that started with the early days of photography – think of the Cottingley Fairies. What happens when you can’t trust your eyes, ears or brains to distinguish reality from fiction?

In a year when there is likely to be a general election in the UK, plus elections in the US and in other economically significant countries, this matters. The World Economic Forum has highlighted the dangers of misinformation and disinformation in its recent Global Risks Report 2024. Companies as well as individuals can suffer serious economic repercussions from fake news and from fake data. At a time when peer-reviewed scientific journals are failing to spot fake scientific papers, what hope have the rest of us?

But if internal auditors start to think like this, they may as well go home. Concerns about the ease with which fake information and deliberate misinformation can be promoted are all the more reason why organisations need their internal audit teams to be on the ball. This is an opportunity and, while internal auditors may not be able to distinguish every lie or piece of false data, they do have more tools to sort the wheat from the chaff than most other functions.

Fake stakes

Chief among these weapons is professional scepticism. Every con man or woman knows that it’s easiest to convince people to do or believe things that they already want to do or believe. Internal auditors are trained to be sceptical. If it looks too good to be true, it probably is. This skill has to be honed and refreshed constantly to avoid falling into traps (even the most tech-savvy person can click on a phishing email if they’re tired or distracted), however internal auditors start from a good base. Question everything – especially the things that seem beyond question – and you’re unlikely to go far wrong.

Second, internal auditors are told to have courage (it’s explicit in the new Global Standards). This is vital when their questions raise unpalatable truths to those in power. However, today it is just as likely to be used to counter a suspicious “truth” that sounds overly convincing to management – strategy based on a false premise or over-confidence based on inaccurate or deliberately skewed data could be disastrous.

Internal audit exists to provide independent assurance. There are more tools to help provide this today than ever before – but also more pitfalls. AI and data analytics will produce information based on the data they draw on. This is all the more dangerous for being comprehensive and, apparently, authoritative. It takes human brains to doubt and to look for inaccurate data or biased questions that create a misleading picture – or to suspect a malicious intent to mislead.

It is no surprise that many chief audit executives (CAEs) say they look for imagination, curiosity and a questioning mind more than specific audit skills or experience when they recruit. These qualities are essential in a good internal auditor, but they also need to be nurtured and encouraged. It’s easy to tell trainees that they should accept what you say, or do what you do, but far better to expect them to question what you teach them and to test whether it is correct.

It’s relatively easy for a charismatic CAE to mould a team in their own image, but far healthier to seek diversity of opinion and approach. Just as the CAE needs to use their scepticism and courage to challenge received opinion or the “truth” of data at senior management level, so they also need to encourage the same traits in their own team. Their opinion and world view should be questioned by colleagues – if nothing else, it gives junior team members practice at challenging authority politely, but robustly.

The truth is an elusive ideal, but internal auditors must continue to seek it, whatever new barriers or false trails attempt to divert their path. This takes personal resilience – questioning things that it’s easier to believe is tiring, and testing widely accepted “facts” takes time and resources. It can sometimes feel like a waste of effort. However, it is only by questioning and testing evidence that internal audit creates real value and resilience for their organisation.

Checks and balances

It seems ironic that the tools that enable us to do impossible tasks, such as deciphering long-lost texts and collecting and extracting information from thousands of utility bills worldwide to assess carbon footprints, can also obscure or manipulate the truth. Internal auditors need to understand the vulnerabilities of technology, just as they have always needed to understand the psychology of fraudsters.

It is also more important than ever to seek information from as many sources as possible, to compare these sources and to establish which are most likely to be trustworthy (although these should still be questioned). The more sources of information you have, the more likely you and your team are to spot a weak link, and the more options you have to check it. These sources could be training courses, contacts in other organisations and sectors, news feeds, colleagues in other regions, specialist forums and expert webinars.

Many of these can be found free or for a moderate cost from the institute, so check out the reports, guidance, forums, special interest groups, courses and events available. Some will also count towards members’ continuing professional education (CPE) requirements, and many will provide opportunities to make contacts who could provide an alternative view, or input into a specialist area, if you need this in future.

The new Global Standards also highlight the need for internal auditors to be professionally competent. Training is an important part of this, but so are a wide, varied knowledge and the ability to put these together and use them in practice. Experience is valuable, particularly if it teaches us to hone our instincts – the internal audit “nose” – but it should also warn us that no one is infallible.

So, take some time out this week to ask whether you are confident that you and your internal audit team are getting to the truth. Are you sceptical enough? Are you brave enough? Are you imaginative enough? Are you well connected and well informed? And do you understand the weaknesses of your tools as well as the benefits they offer? If the answer is yes, you might want to test your findings, just to make sure.

This article was published in March 2024.