The Challenge of Staying Objective

Standard 2.1 Individual Objectivity of the Global Internal Audit Standards requires auditors to demonstrate objectivity, defined as an impartial and unbiased mental attitude that allows auditors to perform engagements without compromise or subordination of judgment to others. The Standards also require professional judgment throughout every engagement: on risk, on evidence, on conclusions. That is a lot of discretion placed in very human hands.

And humans, it turns out, are not wired for objectivity.

Daniel Kahneman spent decades on this problem. His book Thinking, Fast and Slow is not an auditing text, but it might as well be required reading for anyone who signs off on conclusions. His central argument is that we operate through two modes of thinking. System 1 is fast and automatic: pattern recognition, gut feel, shortcuts. System 2 is slow and deliberate, the kind of thinking that actually weighs evidence. The uncomfortable finding is that System 1 runs the show far more than we realize, especially when we are tired, rushed, or working on familiar ground. Which, for many internal auditors, describes most engagements.

Kahneman identified several specific biases that show up in audit work, whether we notice them or not.

Anchoring is the tendency to rely too heavily on the first information you encounter. An auditor reviewing a construction company's procurement controls may read that last year's finding, a minor documentation gap, has since been remediated, and calibrate the rest of the work around it. “Controls improved last year,” he thinks. “Testing can be light this year.” Because of this, he misses a split-purchase pattern — where a single, expensive transaction is intentionally broken down into multiple smaller transactions to bypass spending approval thresholds — until someone in finance mentions it offhand at the closing meeting.

Confirmation bias is subtler. It is not that you ignore contradictory evidence; it’s that you weigh it differently without realizing. An auditor with a positive impression of a department head reads exceptions as isolated and reads compliance as the pattern. The testing looks complete. It probably was. But the conclusion was forming before the evidence was fully in.

Availability bias works through memory rather than logic. An auditor who recently worked a payroll fraud investigation tends to see payroll risk everywhere for a while. Not because the risk profile of the next engagement warrants it, but because that experience is vivid and recent. Risk assessment starts reflecting what happened last quarter, rather than what is actually in front of you.

The halo effect is common in industries like real estate and construction, where personal relationships with project managers and site supervisors run deep. A contractor who consistently delivers projects on time builds a reputation, and so is assumed to be aboveboard in unrelated, areas: contract compliance, vendor selection, budget variance explanations. The auditor does not consciously go easier on the contractor. They just don’t push as hard.

Status quo bias is perhaps the most insidious for auditors who cover the same processes, year after year. A process that has always been low risk feels like a process that will always be low risk. When the business context shifts, with new staff and new pressures, we don’t automatically update this mental classification. When something is familiar, our minds may not be looking for the aberrant.

None of this makes auditors incompetent. It makes us human. We cannot rewire the brain, but what we can do, is build awareness before the fieldwork starts. Write down your assumptions before you test them. Note which teams you find easy to work with and ask yourself whether that ease is affecting your scrutiny. When a process has been clean for three consecutive years, treat that as a reason to look more carefully, not less. And when you document your conclusions, document your reasoning too: not just what you found, but why you went looking where you did, and why you did not look somewhere else.

The biases Kahneman described are not flaws in bad auditors. They are defaults in all auditors. The only meaningful difference is whether you know they are there.