I enjoy working with new auditors, in part because they so often see the world in terms of clear black-and-white issues. “Should we do an audit?” “Should we issue a finding?” “Am I maintaining a healthy degree of professional skepticism?” For many new auditors, each yes-or-no question points unerringly to a single correct answer. 

With experience, our horizons expand and we start to see additional repercussions for our actions. The issue is not merely whether we should perform an audit, but whether budget is available, how extensive an audit is justified, and how soon the audit is needed. The issue is not merely whether or not to report a finding, but how significant the finding is and how strongly to word the description. 

Experience can be even more valuable when we draw the line between maintaining adequate professional skepticism and harboring unwarranted suspicions. Issues regarding skepticism can be emotionally charged because they lie at the core of how we see ourselves as auditors. Professional skepticism means that we take nothing for granted — that we continuously assess audit evidence and other information, and we question what we see and hear. We take pride in never missing a clue or a warning sign, in being al​​ert for the hidden message that some other auditor might miss. We are all aware that without professional skepticism we might fail as auditors.

So why shouldn’t auditors always exhibit extreme professional skepticism? The flip side of the issue is that too much skepticism can actually hamper audit effectiveness. Take, for example, the case of the hyper-suspicious auditor who once worked for me. He always assumed new clients were guilty of something and his job was to “blow the whistle.” Unsurprisingly, the auditor’s working relationships with management and me deteriorated over time. Managers were less than forthcoming during risk assessments and the audit engagement. The auditor’s nature of being overly suspicious eventually led to communications breakdowns and weak audit results.​

​​​​​​For many auditors, our written goals might include partnership-with-management initiatives or other relationship-building initiatives. Unfortunately, maintaining professional skepticism means we can never completely trust the very leaders who would be our partners in these initiatives. In turn, management may become less likely to think of internal auditors as trusted advisers. It’s human nature to trust and confide in people who trust and confide in us — but also to distrust people whose (remarkably poor) judgment makes them suspicious of us. Is it any wonder, then, that taking a hard line on professional skepticism can potentially damage valuable working relationships?

Having a handle on an appropriate level of professional skepticism is critical to long-term internal audit success, but evaluating our own professional skepticism can be dismayingly subjective. One size does not fit all. Some auditors rely more on relationship building; others are more inclined to “dig out the truth” in hard facts. Every situation is unique, and the trick is not merely to decide how much skepticism is enough in general, but to draw the line so clearly that we exhibit just the right degree of professional skepticism in any given situation.

If only we could use a standardized rating system to assess our level of skepticism! Unfortunately, an accurate, flexible rating scale is not likely in the near future. (Imagine a checklist with statements such as, “The interviewee seemed nervous and was sweating profusely. Deduct one skepticism point,” or “The sample size was statistically significant. Add three skepticism points.”)

There’s a fine line between maintaining a healthy degree of professional skepticism and having an overly suspicious attitude. How we decide to draw that line says a lot about us … as auditors and as individuals. To me, the secret is simply to approach each situation with an open mind and to communicate in a way that demonstrates our underlying trust and confidence in management. We will always need to ask the hard questions, but we also need to use tact in deciding how and when to ask the questions.

Former U.S. President Ronald Reagan once said, “trust but verify.” At the time, Reagan was discussing ongoing relationships with a U.S. adversary, but for auditors, “trust but verify” should be words to live by. We need to demonstrate our trust in our co-workers, and we need to verify that our trust continues to be well-placed.​