Jonathan T. Marks CPA, CFF, CFE and NACD Board Fellow

Skepticism – A Key Tool in the Fight Against Fraud

What is wanted is not the will to believe, but the will to find out, which is the exact opposite.” – Bertrand Russell, “Skeptical Essays,” 1928

Questions about professional skepticism – how to define it, how much is enough, what policies support it, and what practices diminish it – are perennial topics of concern among auditors and accountants. These topics also should be of concern to all stakeholders, including a company’s management, board of directors, and audit committee.

In any discussion of fraud detection and prevention, the phrase “trust but verify” is almost certain to come up. Regardless of how apt that concept might have been in the context of Cold War diplomacy, it could be argued that “trust but verify” is actually bad advice when it comes to deterring fraud in general.

In fact, “trust but verify” could be a downright dangerous approach when applied to audit procedures in particular. A much better slogan for fraud deterrence would be, “Trust is a professional hazard.”

Skepticism: It’s Everyone’s Job

Recently, the necessity of professional skepticism has been emphasized repeatedly. For example, in August 2013, Jeanette M. Franzel, board member of the Public Company Accounting Oversight Board (PCAOB), said, “Our inspection results all    too often show that substantial progress is needed in order to more consistently achieve the appropriate application of professional skepticism throughout the audit process and across audits. Additional efforts are needed to better understand how the framework of professional skepticism applies across varying audit situations.”

Months earlier, the PCAOB issued a staff audit practice alert on the topic, which included this cautionary note: “Observations from the PCAOB’s oversight activities continue to raise concerns about whether auditors consistently and diligently apply professional skepticism. Certain circumstances can impede the appropriate application of professional skepticism and allow unconscious biases to prevail, including incentives and pressures resulting from certain conditions inherent in the audit environment, scheduling and workload demands, or an inappropriate level of confidence or trust in management. Audit firms and individual auditors should be alert for these impediments and take appropriate measures to assure that professional skepticism is applied appropriately throughout all audits performed under PCAOB standards.”

It is not just auditors who must be concerned with maintaining appropriate professional skepticism. This point was stressed during a roundtable convened in April 2013 by the Anti-Fraud Collaboration, which comprises the Center for Audit Quality (CAQ), Financial Executives International (FEI), The Institute of Internal Auditors (IIA), and the National Association of Corporate Directors (NACD). The author participated in this program, which had the objective of bringing together some key players – corporate directors, financial executives, external auditors, and internal auditors – from all along the financial reporting supply chain to discuss each group’s expectations and understanding of the various players’ roles in deterring and detecting financial reporting fraud.

Boards, particularly audit committee members, must take care to exercise a skeptical approach to financial reports and supporting information.

A portion of the discussion focused on an initial survey of the four organizations’ members, which produced a number of surprising findings about the attitudes and opinions of the various stakeholders. The roundtable’s summary concluded, “A large majority of survey respondents believe that financial management has primary responsibility in deterring financial reporting fraud, with a smaller majority believing financial management is responsible for detecting financial statement reporting fraud.”

The implication is that because financial management plays a leading role in detecting financial fraud, it is incumbent on executives – not just auditors – to exercise appropriate levels of professional skepticism. Board members and particularly audit committee members also must take care to exercise a skeptical approach to financial reports and supporting information.

Exhibit 1 – Trust vs. Skepticism

Source: “Closing the Expectation Gap in Deterring and Detecting Financial Statement Fraud: A Roundtable Summary,” Anti-Fraud Collaboration, 2013, p. 15

Tellingly, 42 percent of the internal auditors said that their organization exhibits more trust than skepticism. This is a particularly troubling admission considering the paramount role that professional skepticism – not trust – must play in auditors’ performance of duties.The Anti-Fraud Collaboration’s survey also revealed that the various stakeholders’ expectations and opinions about their organizations’ effectiveness in deterring and detecting fraud vary widely. When asked to rate his or her organization’s overall performance, an internal auditor was much less likely to say that his or her organization exhibits the appropriate balance between trust and skepticism. As shown in Exhibit 1, only 46 percent of those affiliated with the IIA said that their organization exhibits the appropriate balance of trust versus skepticism, compared to 58 percent of the financial executives (members of FEI), 70 percent of the external auditors (CAQ members), and 79 percent of the board members (affiliates of NACD) who responded.

Defining the Issue

An obvious early step in helping executives, boards, and auditors decide the appropriate balance between trust and skepticism in their organizations is to come  to a general agreement on what professional skepticism really means. The auditing profession, as one might expect, has devoted considerable effort to defining the term.

The IIA, representing the internal audit profession with approximately 180,000 members worldwide, defines professional skepticism as “the state of mind in which internal auditors take nothing for granted; they continuously question what they hear and see and critically assess audit evidence.” PCAOB standards define professional skepticism as “an attitude that includes a questioning mind and a critical assessment of audit evidence.” It requires an emphasis on the importance of maintaining the proper state of mind throughout the audit.

Over the past 10 years, researchers have developed a theoretical model that views professional skepticism as a function of six fundamental characteristics, including a recognition that individuals might have different perceptions of the same information.

Defining skepticism and identifying its primary traits have also been the subjects of considerable academic and professional research in recent years. In November 2013, the Standards Working Group of the Global Public Policy Committee (GPPC), a consortium of large accounting firms, published a research paper on the topic. The publication, “Enhancing Auditor Professional Skepticism,” was written by professors Steven M. Glover and Douglas F. Prawitt of Brigham Young University. The paper’s stated purpose was to develop “a shared understanding of what professional skepticism is, how it should be applied, the threats to professional skepticism and the safeguards that may be cost effective.”

The authors noted at the outset that “the term ‘professional skepticism’ is widely used but may mean different things to different organizations and individuals.” The writers went on to suggest that “to move the dialogue on improving the consistent appropriate application of professional skepticism forward, it is important that a shared understanding be developed regarding what professional skepticism is, how it should be applied and documented in various situations, and how threats to professional skepticism manifest themselves at different structural levels.”

The GPPC research, like many other efforts, draws partly from academic work by Kathy Hurtt, Martha Eining, and R. David Plumlee. In a series of papers over the past 10 years, these researchers developed a theoretical model that views professional skepticism as a function of six fundamental characteristics:

  1. A questioning mind: Not accepting information at face value but instead looking for evidence or proof to justify the information
  2. Suspension of judgment: A propensity to withhold acceptance or rejection until all information has been found and considered
  3. A search for knowledge: As evidenced by genuine curiosity and enjoyment of learning
  4. Interpersonal understanding: Recognizing that individuals might have different perceptions of the same information
  5. Self-confidence: Valuing one’s own insights and being willing to challenge the assumptions of others
  6. Self-determination: The personal initiative to take action based on the evidence

This multidimensional view and a related 30-question survey the authors developed to provide an empirical measure of individual auditors’ relative skepticism have formed  the basis of much of the academic research on professional skepticism over the past decade. This view also provides a useful explanation of characteristics and behavior that can be inherently difficult to measure objectively.

Ninety-four percent of board members were confident or highly confident that they exercise sufficient skepticism

Exhibit 2 – Confidence That Each Party Exercises Sufficient Skepticism

Source: “Closing the Expectation Gap in Deterring and Detecting Financial Statement Fraud: A Roundtable Summary,” Anti-Fraud Collaboration, 2013, p. 15

Complacency: The Big Challenge

An objective of all this research on professional skepticism is to help identify factors that prevent or discourage auditors – and others in the financial reporting supply chain – from developing and maintaining the appropriate level of skepticism. One of the most prevalent factors is simple complacency – as demonstrated by another response to the Anti-Fraud Collaboration’s survey.

As shown in Exhibit 2, survey respondents were asked to assess their confidence that the various groups responsible for deterring and detecting fraud in their organization were exercising a sufficient level of skepticism.

Of all the groups, board members (NACD members) were most complacent about the performance of responsible parties in their organization. They were almost unanimous (98 percent) in expressing confidence that their company’s internal and external auditors exercise sufficient skepticism. Ninety-four percent of board members were confident or highly confident that they exercise sufficient skepticism themselves.

On the other hand, external auditors (CAQ members) were much less confident in others’ performance. Only 73 percent of the CAQ’s respondents were confident or highly confident that financial executives exercise sufficient skepticism of financial results. External auditors viewed board members and audit committees almost identically to executives.

Internal auditors (IIA members) had roughly the same view of financial executives and even less confidence that board members and audit committees demonstrate appropriate skepticism in reviewing financial information. In other words, the views of internal and external auditors differ significantly from the views of executives and board members.

Other Impediments to Appropriate Skepticism

Complacency is only one attitude that could cause an executive, board member, or auditor to exercise insufficient skepticism when considering financial information. The GPPC’s research paper points out several natural tendencies that can lead to faulty judgment or weakened skepticism:

In addition to personal biases, other challenges can inhibit skepticism. For example, an external auditor’s conflicts of interest and less-than-thorough understanding of the business are areas of legitimate concern.

One of the most significant challenges is deadline pressure. An auditor is naturally under substantial pressure to complete the work and issue the report promptly. A cunning fraudster can take advantage of the situation by initially diverting the auditor’s time and attention to areas that are unlikely to raise concerns and saving problematic areas until the engagement’s end, when time is short. Recognizing and resisting this tactic requires the application of professional skepticism – not only on the part of the external auditor but by the others involved in the process as well.

Beyond Audit: What Other Stakeholders Can Do

Although the GPPC’s research focused on auditors, the same observations – and the same potential weaknesses – apply to everyone in an organization who has the responsibility to detect or deter fraud, from executives with financial reporting responsibilities to the board of directors in general and members of the audit committee in particular. Ultimately, all these individuals have a direct interest in detecting fraud or misstatement and a responsibility to be on guard against complacency or other impediments.

The GPPC study’s authors noted, “While auditors can and must do better in their central role, we believe that a complete solution to the problem of enhancing auditor professional skepticism requires an approach that addresses threats at all structural levels and that involves all of the key stakeholders that share responsibility in enhancing the reliability of the financial reporting process.”

It is essential for all organizations to encourage clear, open communication among all parties concerned. The Anti-Fraud Collaboration’s report noted, “For the roles to operate well together, communication is critical.” The authors went on to advocate “open and candid conversation among the internal and external audit functions, financial management, and the audit committee, allowing for audit committees to perform their governance role with necessary transparency and realistic expectations.”

Beyond this general effort, all stakeholders can take a number of specific steps to encourage appropriate levels of professional skepticism, including the following –

If, as asserted at the outset, trust is indeed a professional hazard for auditors, then it follows that informed, knowledgeable skepticism is a professional asset. That principle applies not only to auditors but also to the board members and financial executives responsible for detecting and deterring fraud of  all  types,  specifically  financial reporting fraud. By challenging their own assumptions – and creating an environment in which such challenges are encouraged and supported – companies will not just   deter fraud but make its detection more likely.

I welcome your thoughts and comments.

Best!

 

Attribution:

Jeanette M. Franzel, “Auditor Objectivity and Skepticism – What’s Next?” American Accounting Association Annual Meeting, Aug. 5, 2013, http:// pcaobus.org/News/Speech/Pages/08052013_AAA. aspx

“Staff Audit Practice Alert No. 10: Maintaining and Applying Professional Skepticism in Audits,” Public Company Accounting Oversight Board, Dec. 4, 2012, http://pcaobus.org/Standards/QandA/12-04- 2012_SAPA_10.pdf

“Closing the Expectation Gap in Deterring and Detecting Financial Statement Fraud: A Roundtable Summary,” Anti-Fraud Collaboration, 2013, p. 3, https://na.theiia.org/standards-guidance/Public%20 Documents/Anti-Fraud%20Collaboration%20Report. pdf

“IIA Chapter 10,” “Quizlet” online study guide, 2014, http://quizlet.com/15259935/iia-chapter-10-flash- cards/

“Staff Audit Practice Alert No. 10.”

Steven M. Glover and Douglas F. Prawitt, “Enhancing Auditor Professional Skepticism,” Global Public Policy Committee, November 2013, p. i, http://www. thecaq.org/docs/research/skepticismreport.pdf

Ibid.

Ibid, p. ii.

The Hurtt Skepticism Scale is summarized in Rosemary Fullerton and Cindy Durtschi, “The Effect of Professional Skepticism on the Fraud

Detection Skills of Internal Auditors,” Social Science Research Network, Nov. 11, 2004, http://ssrn.com/ abstract=617062

“Enhancing Auditor Professional Skepticism,” p. 18.

“Closing the Expectation Gap in Deterring and Detecting Financial Statement Fraud,” p. 10.

Evidence