What is wanted is not the will to believe, but the will to find out, which is the exact opposite.” – Bertrand Russell, “Skeptical Essays,” 1928
Questions about professional skepticism – how to define it, how much is enough, what policies support it, and what practices diminish it – are perennial topics of concern among auditors and accountants. These topics also should be of concern to all stakeholders, including a company’s management, board of directors, and the audit committee.
In any discussion of fraud detection and prevention, the phrase “trust but verify” is almost certain to come up. Regardless of how clever that concept might have been in the context of Cold War diplomacy, it could be argued that “trust but verify” is terrible advice when it comes to deterring fraud in general.
In fact, “trust but verify” could be a downright dangerous approach when applied to audit procedures in particular. A much better slogan for fraud deterrence would be, “Trust is a professional hazard.”
Skepticism: It’s Everyone’s Job
The necessity of professional skepticism has been emphasized repeatedly. For example, in August 2013, Jeanette M. Franzel, board member of the Public Company Accounting Oversight Board (PCAOB), said, “Our inspection results all too often show that substantial progress is needed in order to more consistently achieve the appropriate application of professional skepticism throughout the audit process and across audits. Additional efforts are needed to understand better how the framework of professional skepticism applies across varying audit situations.”
Months earlier, the PCAOB issued a staff audit practice alert on the topic, which included this cautionary note: “Observations from the PCAOB’s oversight activities continue to raise concerns about whether auditors consistently and diligently apply professional skepticism. Certain circumstances can impede the appropriate application of professional skepticism and allow unconscious biases to prevail, including incentives and pressures resulting from certain conditions inherent in the audit environment, scheduling and workload demands, or an inappropriate level of confidence or trust in management. Audit firms and individual auditors should be alert for these impediments and take appropriate measures to assure that professional skepticism is applied appropriately throughout all audits performed under PCAOB standards.”
It is not just auditors who must be concerned with maintaining appropriate professional skepticism. This point was stressed during a roundtable convened in April 2013 by the Anti-Fraud Collaboration, which comprises the Center for Audit Quality (CAQ), Financial Executives International (FEI), The Institute of Internal Auditors (IIA), and the National Association of Corporate Directors (NACD). The author participated in this program, which had the objective of bringing together some key players – corporate directors, financial executives, external auditors, and internal auditors – from all along the financial reporting supply chain to discuss each group’s expectations and understanding of the various players’ roles in deterring and detecting financial reporting fraud.
Boards, particularly audit committee members, must take care to exercise a skeptical approach to financial reports and supporting information.
A portion of the discussion focused on an initial survey of the four organizations’ members, which produced a number of surprising findings about the attitudes and opinions of the various stakeholders. The roundtable’s summary concluded, “A large majority of survey respondents believe that financial management has primary responsibility in deterring financial reporting fraud, with a smaller majority believing financial management is responsible for detecting financial statement reporting fraud.”
The implication is that because financial management plays a leading role in detecting financial fraud, it is incumbent on executives – not just auditors – to exercise appropriate levels of professional skepticism. Board members and particularly audit committee members also must take care to exercise a skeptical approach to financial reports and supporting information.
Source: “Closing the Expectation Gap in Deterring and Detecting Financial Statement Fraud: A Roundtable Summary,” Anti-Fraud Collaboration, 2013, p. 15
Tellingly, 42 percent of the internal auditors said that their organization exhibits more trust than skepticism. This is a particularly troubling admission considering the paramount role that professional skepticism – not trust – must play in auditors’ performance of duties. The Anti-Fraud Collaboration’s survey also revealed that the various stakeholders’ expectations and opinions about their organizations’ effectiveness in deterring and detecting fraud vary widely. When asked to rate his or her organization’s overall performance, an internal auditor was much less likely to say that his or her organization exhibits the appropriate balance between trust and skepticism. As shown in Exhibit 1, only 46 percent of those affiliated with the IIA said that their organization exhibits the appropriate balance of trust versus skepticism, compared to 58 percent of the financial executives (members of FEI), 70 percent of the external auditors (CAQ members), and 79 percent of the board members (affiliates of NACD) who responded.
Defining the Issue
An apparent early step in helping executives, boards, and auditors decide the appropriate balance between trust and skepticism in their organizations is to come to a general agreement on what professional skepticism really means. The auditing profession, as one might expect, has devoted considerable effort to define the term.
The IIA, representing the internal audit profession with approximately 180,000 members worldwide, defines professional skepticism as “the state of mind in which internal auditors take nothing for granted; they continuously question what they hear and see and critically assess audit evidence.” PCAOB standards define professional skepticism as “an attitude that includes a questioning mind and a critical assessment of audit evidence.” It requires an emphasis on the importance of maintaining the proper state of mind throughout the audit.
Over the past ten years, researchers have developed a theoretical model that views professional skepticism as a function of six fundamental characteristics, including a recognition that individuals might have different perceptions of the same information.
Defining skepticism and identifying its primary traits have also been the subjects of considerable academic and professional research in recent years. In November 2013, the Standards Working Group of the Global Public Policy Committee (GPPC), a consortium of large accounting firms, published a research paper on the topic. The publication, “Enhancing Auditor Professional Skepticism,” was written by professors Steven M. Glover and Douglas F. Prawitt of Brigham Young University. The paper’s stated purpose was to develop “a shared understanding of what professional skepticism is, how it should be applied, the threats to professional skepticism and the safeguards that may be cost-effective.”
The authors noted at the outset that “the term ‘professional skepticism’ is widely used but may mean different things to different organizations and individuals.” The writers went on to suggest that “to move the dialogue on improving the consistent, appropriate application of professional skepticism forward, it is important that a shared understanding be developed regarding what professional skepticism is, how it should be applied and documented in various situations, and how threats to professional skepticism manifest themselves at different structural levels.”
The GPPC research, like many other efforts, draws partly from academic work by Kathy Hurtt, Martha Eining, and R. David Plumlee. In a series of papers over the past ten years, these researchers developed a theoretical model that views professional skepticism as a function of six fundamental characteristics:
- A questioning mind: Not accepting information at face value but instead looking for evidence or proof to justify the information
- Suspension of judgment: A propensity to withhold acceptance or rejection until all information has been found and considered
- A search for knowledge: As evidenced by genuine curiosity and enjoyment of learning
- Interpersonal understanding: Recognizing that individuals might have different perceptions of the same information
- Self-confidence: Valuing one’s insights and being willing to challenge the assumptions of others
- Self-determination: The personal initiative to take action based on the evidence
This multidimensional view and a related 30-question survey the authors developed to provide an empirical measure of individual auditors’ relative skepticism have formed the basis of much of the academic research on professional skepticism over the past decade. This view also provides a useful explanation of characteristics and behavior that can be inherently difficult to measure objectively.
Ninety-four percent of board members were confident or highly confident that they exercise sufficient skepticism
Source: “Closing the Expectation Gap in Deterring and Detecting Financial Statement Fraud: A Roundtable Summary,” Anti-Fraud Collaboration, 2013, p. 15
Complacency: The Big Challenge
An objective of all this research on professional skepticism is to help identify factors that prevent or discourage auditors – and others in the financial reporting supply chain – from developing and maintaining the appropriate level of skepticism. One of the most prevalent factors is simple complacency – as demonstrated by another response to the Anti-Fraud Collaboration’s survey.
As shown in Exhibit 2, survey respondents were asked to assess their confidence that the various groups responsible for deterring and detecting fraud in their organization were exercising a sufficient level of skepticism.
Of all the groups, board members (NACD members) were most complacent about the performance of responsible parties in their organization. They were almost unanimous (98 percent) in expressing confidence that their company’s internal and external auditors exercise sufficient skepticism. Ninety-four percent of board members were confident or highly confident that they apply sufficient skepticism themselves.
On the other hand, external auditors (CAQ members) were much less confident in others’ performance. Only 73 percent of the CAQ’s respondents were confident or highly confident that financial executives exercise sufficient skepticism of financial results. External auditors viewed board members and audit committees almost identically to executives.
Internal auditors (IIA members) had roughly the same view of financial executives and even less confidence that board members and audit committees demonstrate appropriate skepticism in reviewing financial information. In other words, the opinions of internal and external auditors differ significantly from the views of executives and board members.
Other Impediments to Appropriate Skepticism
Complacency is only one attitude that could cause an executive, board member, or auditor to exercise insufficient skepticism when considering financial information. The GPPC’s research paper points out several natural tendencies that can lead to faulty judgment or weakened skepticism:
- Overconfidence. Decision-makers must be careful not to overestimate their abilities and understanding of issues. Overconfidence can lead them to challenge statements, assumptions, and procedures insufficiently.
- Confirmation bias. It’s natural to give more weight to information that confirms our opinions. This inclination can bias a wide variety of auditor judgments and cause executives and board members to see what they expect to see.
- Anchoring. Anchoring is the tendency to start with initial values and data that are familiar. An auditor can be influenced inappropriately by the previous year’s account details, for example.
- Availability. Information that is easily accessible (or available from memory) is often considered less relevant to a decision than information from alternative sources. As a result, auditors unconsciously might not apply the most relevant information to the audit.
In addition to personal biases, other challenges can inhibit skepticism. For example, an external auditor’s conflicts of interest and less-than-thorough understanding of the business are areas of legitimate concern.
One of the most significant challenges is deadline pressure. An auditor is naturally under substantial pressure to complete the work and issue the report promptly. A cunning fraudster can take advantage of the situation by initially diverting the auditor’s time and attention to areas that are unlikely to raise concerns and saving problematic areas until the engagement’s end, when time is short. Recognizing and resisting this tactic requires the application of professional skepticism – not only on the part of the external auditor but by the others involved in the process as well.
Beyond Audit: What Other Stakeholders Can Do
Although the GPPC’s research focused on auditors, the same observations – and the corresponding potential weaknesses – apply to everyone in an organization who has the responsibility to detect or deter fraud, from executives with financial reporting responsibilities to the board of directors in general and members of the audit committee in particular. Ultimately, all these individuals have a direct interest in detecting fraud or misstatement and a responsibility to be on guard against complacency or other impediments.
The GPPC study’s authors noted, “While auditors can and must do better in their central role, we believe that a complete solution to the problem of enhancing auditor professional skepticism requires an approach that addresses threats at all structural levels and that involves all of the key stakeholders that share responsibility in enhancing the reliability of the financial reporting process.”
It is essential for all organizations to encourage transparent, open communication among all parties concerned. The Anti-Fraud Collaboration’s report noted, “For the roles to operate well together, communication is critical.” The authors went on to advocate “open and candid conversation among the internal and external audit functions, financial management, and the audit committee, allowing for audit committees to perform their governance role with necessary transparency and realistic expectations.”
Beyond this general effort, all stakeholders can take some specific steps to encourage appropriate levels of professional skepticism, including the following –
- Self-criticize each significant judgment. Make it a point to play the role of the independent reviewer or inspector, particularly of your own assumptions. A professional skeptic continuously challenges his or her beliefs and belief-based risk assessments. Critical self-assessment is necessary to demonstrate to others why and how beliefs and assessments are justified.
- Make an effort to resist complacency and other natural tendencies such as confirmation bias. Question whether you are placing undue weight on prior risk assessments or discounting evidence inconsistent with your with your expectations.
- Be alert to Pressure. Pay particular attention to pressure to truncate risk assessment procedures or make unwarranted assumptions to beat time constraints. This step is especially important as deadlines approach.
- Understand the sources of evidence. Identify and assess audit risks from multiple perspectives, using multiple sources of evidence,
- Be aware of the relative reliability of various types of evidence. In general, documentation from internally generated documents – particularly those that are generated manually or not linked to other reporting systems – is less reliable as evidence than documents generated by external sources such as banks or suppliers. See graphic below.
If, as asserted at the outset, trust is indeed a professional hazard for auditors, then it follows that informed, knowledgeable skepticism is a professional asset. That principle applies not only to auditors but also to the board members and financial executives responsible for detecting and deterring fraud of all types, specifically financial reporting fraud. By challenging their own assumptions – and creating an environment in which such challenges are encouraged and supported – companies will not just deter fraud but make its detection more likely.
I welcome your thoughts and comments.
“Staff Audit Practice Alert No. 10: Maintaining and Applying Professional Skepticism in Audits,” Public Company Accounting Oversight Board, Dec. 4, 2012, http://pcaobus.org/Standards/QandA/12-04- 2012_SAPA_10.pdf
“Closing the Expectation Gap in Deterring and Detecting Financial Statement Fraud: A Roundtable Summary,” Anti-Fraud Collaboration, 2013, p. 3, https://na.theiia.org/standards-guidance/Public%20 Documents/Anti-Fraud%20Collaboration%20Report. pdf
“Staff Audit Practice Alert No. 10.”
Ibid, p. ii.
The Hurtt Skepticism Scale is summarized in Rosemary Fullerton and Cindy Durtschi, “The Effect of Professional Skepticism on the Fraud
“Enhancing Auditor Professional Skepticism,” p. 18.
“Closing the Expectation Gap in Deterring and Detecting Financial Statement Fraud,” p. 10.