Balancing scepticism in internal audits

Amanda Bradley, GSK’s director of risk and strategy, audit and assurance, discusses the importance of finding the right balance of open-mindedness and scepticism when conducting internal audits.

Greg House, the acerbic head of diagnostic medicine played by Hugh Laurie in the hit US TV show, House MD, has one golden rule when evaluating patients: “Everybody lies”. He ignores what the patient tells him in favour of what biology has to say. He is the ultimate sceptic. He has an exemplary record for saving lives, but he’s distrusted by his peers, disrespectful of others and unapproachable. 

In contrast, his best friend James Wilson, head of oncology, is open-minded, respected and loved. But he is also walked over, put upon and used. So, which of them is the better doctor? This question poses as a good metaphor for considering scepticism and open-mindedness. 

Internal auditors need to be able to get to the heart of what is happening in an organisation. We need to be approachable, so people can tell us things they don’t think others will want to hear, and we need to tell people the truth in an acceptable way. House says of Wilson: “This guy’s so good, people thank him for telling them that they're dying... I don’t get thanked that often.” 

Be the sceptic

As auditors we also need to validate our claims, seek the truth and not take things at face value – assuming that “everybody lies”. The sceptical auditor trusts only in facts and data; verifies everything and pushes past convenient interpretations of the business to find underlying issues.

This sounds very noble. It also sounds very sensible when you have concerns about the veracity of situations, for example, where an auditee’s turnover has shot up unexpectedly. However, when used in the wrong situation, the sceptical auditor can come across closed, doubting and disconnected. They can be perceived as not being on the same team as the auditee because they approach the auditee as though they are most likely lying. At its extreme, that can lead to people hiding information; a confrontational audit tone; and less insightful findings because of the lack of trust between auditor and auditee. 

The approach can also harm an auditor’s ability to influence the business to strengthen the control framework of their organisation. If we are constantly seeking out things that are not working, we can stop ourselves from seeing what does work. This means only half our job is done: failings have been highlighted and the client has proposed a corrective action, but if we don’t know what good looks like, how can we tell that the right corrective action is being proposed?

Be open-minded

Alternatively we can approach the auditee as the expert and see our role as being a partner to the business, not police officers. The open-minded auditor trusts the auditee’s judgement, asks open questions and looks to learn from the auditee. 

An open-minded auditor is non-partisan and able to see the good practices, as well as the improvement areas. This supports the development of the internal control framework, and means that the auditor is able to challenge on the best corrective actions to put in place because they have seen what good looks like.

But there are serious downsides to extremes of open-mindedness too. If we believe everything the auditee says, we are threatening our independence. We can come across as naive in our outlook, our reports will lack credibility and we can end up being ignored. Open-mindedness combined with a lack of technical knowledge of the process being audited opens us up to be bamboozled by the auditee. When issues arise later, the questions raised are: “Where was audit? Why didn’t they spot this?” 

Be both? 

Is there a way to hold both perspectives in perfect tension? It’s a bit of a trick question, because there has to be. Let’s get back to our two fabulous doctors. Which doctor would you like to evaluate you if you’re dying but no-one knows why and there’s a possibility that you could be saved? My money would be on Greg House. 

Who would I want to break the news to me and my family if I only had six months to live? Well, I’d pick Wilson every time. The best doctors are a combination of the two; harnessing the benefits of each approach without falling foul of the downsides. Similarly, auditors can be sceptically open-minded or open-mindedly sceptical. The real question is: Which style do we start with or allow to dominate? Here, asking yourself a couple of simple questions will help you to identify which end of the scale you need to be at. 

1. Is it appropriate to be open-minded or sceptical? Are there any compelling reasons why you should be more sceptical? Does the market have a high Corruption Perception Index (CPI) rating, for example? Are there any alarm bells which are causing you to think there might be something else going on beneath the surface, such as results rocketing up? Are you seeing anything in early planning and scoping that may be considered “too good to be true”?

2. Do I have enough business knowledge in the audit team to be able to be open-minded? Are you auditing an area for the first time or is there a significant gap between the knowledge of the team and the auditee? For example, are you auditing a specialist area like corporate treasury? If you don’t know the area, you are at the auditee’s mercy!

Imagine that it is 2014 and you are an auditor at VW who has undertaken countless audits over the preceding 10 years. Would you have taken a sceptical or open-minded approach to auditing VW’s engine emissions? It’s easy to look back and say: “Of course.” But let’s be honest as we apply the questions. 

Was there a compelling reason to be more sceptical? This was a German corporation operating in major markets and lower CPI index countries, with solid processes in place and a reputation for excellence. But then, suddenly, diesel engine performance increases significantly. 

Would you have switched from open-minded to sceptical dominance? While I’d like to say: “Absolutely.” The truth is probably something less absolute, which makes me wonder why. 

Know your style

Early in my career, when working in an area I didn’t know very well, everything the auditee was telling me made perfect sense. I took information back to my audit senior who confirmed that all seemed in order. I found it hard to move away from open-mindedness and I suspect that I was relatively easy to lead astray.

Two years on, I had seen a lot more. The balance had flipped and it actually became a lot harder to be open-minded. Auditing in the former Eastern Bloc, I was immediately suspicious whenever I found something that appeared well controlled. So at different phases in my career, I was pre-disposed to one approach or the other.

The first step in mastering the ability to flex your auditing approach is to know your natural style. Are you naturally more sceptical or open-minded? Unfortunately, there’s no handy test you can do to tell you which you are. You need to listen to the language you use and the first thought you have when seeing something that looks well controlled. Then, you can train your second thought to be: “Is this response appropriate in this situation?” 

Think Russian

The Russian proverb “doveyai no proveryai”, means “trust but verify”.  If we trust but verify, we can be open-minded in outlook and demeanour, while relying on the facts and data espoused by scepticism. 

If we know our natural predisposition and we trust but verify, we can be more mindful as we audit. We can push ourselves to remain unbiased, but validate the claims the auditee makes. If we do these things, we will add value to the business and inspire our colleagues to meaningful action. 

One final point on the sceptics though. One dictionary definition is: “A person inclined to question or doubt accepted opinions.” Using that definition, one could argue that being a sceptic is actually the ultimate in open-mindedness and this leads me to think that House’s mindset is the right one for us as auditors. He never closes down an avenue of inquiry – in his mind anything is possible, you just need to keep going until you find the truth. It’s just he’s not very nice as he’s doing it. Wrapping up House’s mind in Wilson’s behaviours would make the best of doctors.

By nature of our independence, we cannot be the ones who fix the business. We are not surgeons cutting out the cancerous risk. We make diagnoses and work with the business while it chooses the best treatment. The patient, our business, has to believe in the risk to stay compliant when taking the corrective and preventative action medicine and managing their risk environment. But our behaviours and mindset through the process can make the patient experience better and the medicine easier to swallow.

Further information

Scepticism continues to be a hot topic in both the internal and external audit worlds. Amanda Bradley's article explores some of the internal audit aspects and some thinking from external auditors can be found as follows, where risk factors include management bias and the issue of confirmatory evidence, knowledge and professional judgement, for example, but the relationship with the client is more prescribed:

• 'Enhancing Auditor Professional Skepticism' by the Centre for Audit Quality;
• 'Auditor Sceptism: Raising the Bar', by the FRC,
• The IAASB's 'Focus on Audit Quality' webpages, and
• The Audit and Assurance Faculty's series of videos on professional scepticism.