View from IIA Global: Scepticism: whose job is it, anyway?
As internal auditors, we pride ourselves on our professional scepticism. We take nothing at face value, and when we ask questions, we rarely assume that the first answer we receive is necessarily true. We design our audit programmes with a sceptical eye, and our policies and procedures help to ensure that we exercise an adequate degree of scepticism throughout every audit engagement.
Until now, that might have been a reasonable approach to scepticism. But we are living in extraordinary times, and extraordinary times call for extraordinary measures. The pandemic is changing everything about the way we do business: in a recent survey by McKinsey & Co, a third of surveyed companies indicated that, in response to the pandemic, they were accelerating the digitisation of their supply chains. Half were speeding up the digitisation of their customer channels, and two-thirds were speeding up adoption of artificial intelligence and automation.
That’s only a fraction of the changes our organisations are making this year. And internal auditors know that when systems change breakdowns are likely to occur. The need for scepticism in business has never been greater, because we need to ensure that business transformation means business breakthroughs, not breakdowns.
Internal auditors have new challenges this year. Many are working remotely, and that makes it tougher than ever to examine physical evidence. Face-to-face interviews are being replaced by phone calls, making it harder to evaluate testimonial evidence or client attitudes. Audits are being shortened or postponed to make room in the schedule for emerging risks.
Because internal audit is changing, we need to reevaluate whether our policies, procedures and quality mechanisms provide enough direction to ensure that we approach every engagement with appropriate professional scepticism. The internal audit function is not immune from the rule that breakdowns occur when processes and systems change. It’s time for us to apply our professional scepticism to audit processes and procedures – even to be sceptical about our own scepticism.
Maintaining an appropriate level of professional scepticism isn’t easy. We can’t do it simply by following a checklist. Instead, it is a mindset that must be applied pervasively, from designing the audit programme to gathering and evaluating the evidence. Throughout every audit, we must maintain an attitude that says: “I may like these people and I may understand what they are telling me, but I must verify the facts independently and objectively. I neither believe nor disbelieve until that verification is complete. I neither trust nor distrust.”
While it’s vitally important that we maintain our professional scepticism, maybe it’s also time for us to help ensure that there is a culture of healthy scepticism throughout our organisations. It’s difficult for people to be objective about operations they control. That’s one of the reasons internal auditing adds value. But we can’t audit everything. There are likely to be quite a few areas in your audit universe that have not been audited for several years. If we can promote a healthy degree of scepticism throughout the organisation, problems might rise to the surface and be addressed before they fester.
It’s not easy to promote an atmosphere throughout an organisation that’s simultaneously sceptical and upbeat. Constructive criticism is valuable, but sceptics can come across as naysayers or voices of doom. Workplace sceptics may be marginalised by their co-workers or viewed as distrustful or pessimistic. And business scepticism is more than asking tough questions. Effective sceptics must be smart enough to spot potential issues, brave enough to raise these issues, and tactful enough to do so in a way that creates positive change.
It’s a tough job, but nobody is better equipped than an internal auditor to promote the benefits of business scepticism. Nobody is better equipped to evaluate the level of business scepticism throughout the organisation and, if warranted, make suggestions for changes.
The Anti-Fraud Collaboration, of which IIA Global is one of four sponsoring organisations, recently released a paper that cuts to the core of the notion “trust but verify”. By examining methods for detecting and deterring financial statement fraud – or, indeed, any type of fraud – the paper focuses on the importance of practising scepticism and refusing to accept any information or practices we observe with blind faith.
I encourage you to take a look at the new Anti-Fraud Collaboration paper, “Skepticism in Practice”, which probes how to use scepticism to fight fraud, how biases threaten scepticism, managing risks of emerging technologies, dealing with crises and actionable steps for enhancing scepticism. The collaboration also includes an informative video in which I discuss these issues with Margot Cella, vice-president of research and anti-fraud initiatives at our partner Center for Audit Quality.
This article was first published in November 2020.