On the Frontlines: Auditor Skepticism

As a young man growing up, when television consisted of three channels driven by 1970s culture shows, I must admit I learned a lot about ethics, character, and the vagaries of human behavior watching Star Trek. The fifth episode of the first season, "The Enemy Within," still resonates with its contemporary look at the unpredictability of human behavior.

In true Star Trek   fashion, the relative calm of traveling "where no man (or woman) has   gone before" is broken by a crisis that strikes the crew, causing a dilemma. In this   episode, while beaming up from a planet, a transporter malfunction causes   Captain Kirk to be split into two people: one "good," but   indecisive and ineffectual; the other "evil," impulsive, and   irrational. First Officer Spock must work with Chief Engineer   "Scotty" to rejoin the good and evil sides of Kirk.

I admire how the writers balanced Spock's logic off Kirk's emotional human   side to show the complexity of how decisions are formed. Yet, I question   whether it is realistic, in real life, to maintain a sense of skepticism   across all audits, large and small, without a structured approach. There are   at least two huge challenges to maintaining skepticism long-term.1. Hard   Work

The literal definition of skepticism is an active process of "inquiring" and   "reflection" — processes that suggest questioning, careful   observation, probing reflection, and suspension of belief. Sounds like an   audit, doesn't it? Skepticism is not just words, or a consideration in an   audit, it is a process of discovery of the unknown.

Ancient philosophical skeptics evolved into two branches. One branch denied   all possibility of knowledge or certainty. The second branch advocated   suspension of judgment until sufficient evidence is found. No matter the   obvious challenge of defining skepticism, if the process becomes too   bureaucratic, the rigor of audit skepticism will wane over   time.2. Heuristic Risk - Judgment

Behavioral risk literature often promotes popular theoretical anecdotes for   change, but to paraphrase the father of behavioral science, Dan Kahneman:   "An increase in awareness of biases has not been transformative in   behavioral change."

The second challenge to sustainable skepticism is the fluidity of judgment   in complex organizations. Questions about risk include issues of value and   assigned probabilities that can change as the organization evolves. One   high-flying division may enjoy great influence while others may experience   more scrutiny.

Maintaining skepticism also will require being responsive during periods of   rapid change. But that begs the question: How does internal audit anticipate   and prepare for change in judgment posture?

These are just examples of the questions auditors should consider when   thinking about skepticism. One suggestion to create sustainable auditor   skepticism is to not rely solely on individual judgment. Questionable or   borderline financial engineering or risk-taking require consultation to   maintain the appropriate balance.Finding Balance in Skepticism

I have found that developing a process to deal with tough subjects is more   effective when diverse leadership is involved and a commitment to   transparency exists. In the event of an issue, a discovery process should be   available to management to ensure consistency, impartiality, and balance in   presenting all sides.

Ground rules for operationalizing skepticism should consider the need for   training, risk assessment tools, and senior-level engagement. Many   organizations currently have processes to address skepticism for   run-of-the-mill issues. For more challenging and complex issues, a team   effort is required to build institutional learning and consensus that ensures   the right balance.

Transparent processes also require appropriate levels of confidentiality.   The process for vetting questionable practices should not become a punitive   one but one of discovery and best practice that leads to better   outcomes.

I hope this post helps organizations that have begun to discuss how to   build sustainable processes that evolve with their business.

James Bone is executive director of GRCIndex and principal   investigator at the Cognitive Risk Institute in Lincoln, R.I.​