Skepticism: A Key Tool in the Fight Against Fraud

What is wanted is not the will to believe, but the will to find out, which is the exact opposite.” – Bertrand Russell, “Skeptical Essays,” 1928

Questions about professional skepticism—how to define it, how much is enough, what policies support it, and what practices diminish it—are perennial topics of concern among auditors and accountants. These topics should also concern all stakeholders, including a company’s management, the board of directors, and the audit committee. In any fraud detection and prevention discussion, the phrase “trust but verify” is almost certain to come up. Despite its cleverness in Cold War diplomacy, one could argue that "trust but verify" provides terrible advice for deterring fraud in general. In fact, “trust but verify” could be a downright dangerous approach when applied to audit procedures in particular. A much better slogan for fraud deterrence would be, “Trust is a professional hazard...verify!”

Skepticism: It’s Everyone’s Job

Experts have repeatedly emphasized the necessity of professional skepticism. In August 2013, Jeanette M. Franzel, a board member of the Public Company Accounting Oversight Board (PCAOB), asserted, "Our inspection results consistently demonstrate the need for substantial progress to ensure the appropriate application of professional skepticism throughout the audit process and across audits." We need to make more efforts to comprehend the application of the professional skepticism framework in diverse audit scenarios. Months earlier, the PCAOB issued a staff audit practice alert on the topic, which included this cautionary note: “Observations from the PCAOB’s oversight activities continue to raise concerns about whether auditors consistently and diligently apply professional skepticism. There are situations that can make it hard to use professional skepticism correctly and let unconscious biases take over. These situations include pressures and incentives that come from the audit environment itself, problems with scheduling and workload, or having too much faith or confidence in management. Audit firms and individual auditors should remain vigilant for these impediments and implement suitable measures to ensure the appropriate application of professional skepticism in all audits conducted under PCAOB standards. It is not just auditors who must be concerned with maintaining appropriate professional skepticism. The Anti-Fraud Collaboration, which includes the Center for Audit Quality (CAQ), Financial Executives International (FEI), the Institute of Internal Auditors (IIA), and the National Association of Corporate Directors (NACD), emphasized this point during a roundtable in April 2013. The author participated in this program, which had the objective of bringing together some key players—corporate directors, financial executives, external auditors, and internal auditors—from all along the financial reporting supply chain to discuss each group’s expectations and understanding of the various players’ roles in deterring and detecting financial reporting fraud.

Boards, particularly audit committee members, must take care to exercise a skeptical approach to financial reports and supporting information.

A portion of the discussion focused on an initial survey of the four organizations’ members, which produced a number of surprising findings about the attitudes and opinions of the various stakeholders. The roundtable’s summary concluded, “A large majority of survey respondents believe that financial management has primary responsibility in deterring financial reporting fraud, with a smaller majority believing financial management is responsible for detecting financial statement reporting fraud.” The implication is that because financial management plays a leading role in detecting financial fraud, it is incumbent on executives—not just auditors—to exercise appropriate levels of professional skepticism. Board members, particularly audit committee members, must exercise a skeptical approach to financial reports and supporting information. Source: “Closing the Expectation Gap in Deterring and Detecting Financial Statement Fraud: A Roundtable Summary.” Anti-Fraud Collaboration, 2013, p. 15 Tellingly, 42 percent of the internal auditors said that their organization exhibits more trust than skepticism. This is a particularly troubling admission considering the paramount role that professional skepticism, not trust, must play in auditors’ performance of duties. The Anti-Fraud Collaboration survey also revealed that the various stakeholders’ expectations and opinions about their organizations’ effectiveness in deterring and detecting fraud vary widely. When asked to rate his or her organization’s overall performance, an internal auditor was much less likely to say that his or her organization exhibits the appropriate balance between trust and skepticism. As shown in Exhibit 1, only 46 percent of those affiliated with the IIA said that their organization exhibits the appropriate balance of trust versus skepticism, compared to 58 percent of the financial executives (members of FEI), 70 percent of the external auditors (CAQ members), and 79 percent of the board members (affiliates of NACD) who responded.

Defining the Issue

An apparent first step in helping executives, boards, and auditors determine the appropriate balance between trust and skepticism in their organizations is to agree on what professional skepticism really means. As one might expect, the auditing profession has devoted considerable effort to defining the term. The IIA, representing the internal audit profession with approximately 180,000 members worldwide, defines professional skepticism as “the state of mind in which internal auditors take nothing for granted; they continuously question what they hear and see and critically assess audit evidence.” PCAOB standards define professional skepticism as “an attitude that includes a questioning mind and a critical assessment of audit evidence.” It places an emphasis on the importance of maintaining a proper state of mind throughout the audit.

Over the past ten years, researchers have developed a theoretical model that views professional skepticism as a function of six fundamental characteristics, including a recognition that individuals might have different perceptions of the same information.

Defining skepticism and identifying its primary traits have also been the subject of considerable academic and professional research in recent years. In November 2013, the Standards Working Group of the Global Public Policy Committee (GPPC), a consortium of large accounting firms, published a research paper on the topic. Professors Steven M. Glover and Douglas F. Prawitt of Brigham Young University wrote the publication, "Enhancing Auditor Professional Skepticism." The stated purpose of the paper was to foster a shared understanding of professional skepticism, its application, potential threats, and cost-effective safeguards. At the outset, the authors noted that while 'professional skepticism' is a widely used term, its meaning varies among different organizations and individuals. The writers suggested that developing a shared understanding of professional skepticism, its application and documentation in various situations, and the manifestation of threats to professional skepticism at different structural levels is crucial to advance the dialogue on improving the consistent, appropriate application of professional skepticism. The GPPC research, like many other efforts, draws partly from academic work by Kathy Hurtt, Martha Eining, and R. David Plumlee. In a series of papers over the past ten years, these researchers developed a theoretical model that views professional skepticism as a function of six fundamental characteristics:

1. A questioning mind: Not accepting information at face value but instead looking for evidence or proof to justify the information
2. Suspension of judgment: A propensity to withhold acceptance or rejection until all information has been found and considered
3. A search for knowledge: As evidenced by genuine curiosity and enjoyment of learning
4. Interpersonal understanding: Recognizing that individuals might have different perceptions of the same information
5. Self-confidence: Valuing one’s insights and being willing to challenge the assumptions of others
6. Self-determination: The personal initiative to take action based on the evidence

This multidimensional view and a related 30-question survey the authors developed to provide an empirical measure of individual auditors’ relative skepticism have formed the basis of much of the academic research on professional skepticism over the past decade. This view also provides a useful explanation of characteristics and behavior that can be inherently difficult to measure objectively.

Ninety-four percent of board members were confident or highly confident that they exercise sufficient skepticism

Source: “Closing the Expectation Gap in Deterring and Detecting Financial Statement Fraud:A Roundtable Summary,” Anti-Fraud Collaboration, 2013, p. 15

Complacency: The Big Challenge

The objective of all this research on professional skepticism is to help identify factors that prevent or discourage auditors—and others in the financial reporting supply chain—from developing and maintaining the appropriate level of skepticism. One of the most prevalent factors is simple complacency, as demonstrated by another response to the Anti-Fraud Collaboration’s survey. Exhibit 2 illustrates that the survey asked respondents to evaluate their level of confidence in the various groups responsible for deterring and detecting fraud in their organization. Of all the groups, board members (NACD members) were most complacent about the performance of responsible parties in their organization. They were almost unanimous (98 percent) in expressing confidence that their company’s internal and external auditors exercise sufficient skepticism. Ninety-four percent of board members were confident or highly confident that they applied sufficient skepticism themselves. On the other hand, external auditors (CAQ members) were much less confident in others’ performance. Only 73 percent of the CAQ’s respondents were confident or highly confident that financial executives exercise sufficient skepticism about financial results. External auditors viewed board members and audit committees almost identically to executives. Internal auditors (IIA members) had roughly the same view as financial executives, with even less confidence that board members and audit committees demonstrate appropriate skepticism in reviewing financial information. In other words, the opinions of internal and external auditors differ significantly from the views of executives and board members.

Other Impediments to Appropriate Skepticism

Complacency is only one attitude that could cause an executive, board member, or auditor to exercise insufficient skepticism when considering financial information. The GPPC’s research paper points out several natural tendencies that can lead to faulty judgment or weakened skepticism:

• Overconfidence. Decision-makers must be careful not to overestimate their abilities and understanding of issues. Overconfidence can lead them to challenge statements, assumptions, and procedures insufficiently.
• Confirmation bias. It’s natural to give more weight to information that confirms our opinions. This inclination can bias a wide variety of auditor judgments and cause executives and board members to see what they expect to see.
• Anchoring. Anchoring is the tendency to start with familiar initial values and data. For example, an auditor can be influenced inappropriately by the previous year’s account details.
• Availability. Information that is easily accessible (or available from memory) is often considered less relevant to a decision than information from alternative sources. As a result, auditors unconsciously might not apply the most relevant information to the audit.

In addition to personal biases, other challenges can inhibit skepticism. For example, an external auditor’s conflicts of interest and less-than-thorough understanding of the business are areas of legitimate concern. One of the most significant challenges is deadline pressure. An auditor is naturally under substantial pressure to complete the work and issue the report promptly. A cunning fraudster can exploit this situation by initially focusing the auditor's time and attention on areas that are unlikely to raise concerns, and then delaying problematic areas until the end of the engagement, when time is limited. Recognizing and resisting this tactic requires the application of professional skepticism, not only on the part of the external auditor but also by the others involved in the process.

Beyond Audit: What Other Stakeholders Can Do

Although the GPPC’s research focused on auditors, the same observations—and the corresponding potential weaknesses—apply to everyone in an organization who has the responsibility to detect or deter fraud, from executives with financial reporting responsibilities to the board of directors in general and members of the audit committee in particular. Ultimately, all these individuals have a direct interest in detecting fraud or misstatements and are responsible for guarding against complacency or other impediments. The GPPC study’s authors noted, “While auditors can and must do better in their central role, we believe that a complete solution to the problem of enhancing auditor professional skepticism requires an approach that addresses threats at all structural levels and that involves all of the key stakeholders that share responsibility in enhancing the reliability of the financial reporting process.” It is critical for all organizations to promote transparent, open communication among all parties involved. The Anti-Fraud Collaboration’s report noted, “For the roles to operate well together, communication is critical.” The authors went on to advocate "open and candid conversation among the internal and external audit functions, financial management, and the audit committee, allowing for audit committees to perform their governance role with necessary transparency and realistic expectations.” Beyond this general effort, all stakeholders can take some specific steps to encourage appropriate levels of professional skepticism, including the following:

• Self-criticize each significant judgment. Make it a point to play the role of the independent reviewer or inspector, particularly of your own assumptions. A professional skeptic continuously challenges his or her beliefs and belief-based risk assessments. Critical self-assessment is necessary to demonstrate to others why and how beliefs and assessments are justified.
• Make an effort to resist complacency and other natural tendencies such as confirmation bias. The question is whether you are placing undue weight on prior risk assessments or discounting evidence inconsistent with your expectations.
• Be alert to Pressure.?Pay particular attention to pressure to truncate risk assessment procedures or make unwarranted assumptions to beat time constraints. This step is especially important as deadlines approach.
• Understand the sources of evidence.??Identify and assess audit risks from multiple perspectives, using multiple sources of evidence,
• Be aware of the relative reliability of various types of evidence.?In general, documentation from internally generated documents – particularly those that are generated manually or not linked to other reporting systems – is less reliable as evidence than documents generated by external sources such as banks or suppliers.? See the graphic below.

Recently

In recent enforcement actions, the SEC and DOJ have underscored the critical role of professional skepticism in protecting investors and ensuring the integrity of financial markets. Here are key cases and takeaways:

?Delphia (USA) Inc. and Global Predictions Inc. (2024)

• Key Issue: These firms were charged with making false and misleading statements about their AI capabilities. Delphia misrepresented its AI model’s ability to predict investment opportunities, while Global Predictions falsely claimed to be the “first regulated AI financial advisor.”
• Takeaway: Investment advisers must ensure their representations about AI and other technologies are truthful. This case highlights the importance of verifying claims thoroughly before presenting them to clients and investors .

Crosby Independent School District (2023)

• Key Issue: The SEC sanctioned the auditor for not exercising professional judgment and skepticism during a municipal bond financing process. The auditor failed to challenge misleading information provided by the issuer, which was included in financial disclosures.
• Takeaway: Auditors play a crucial role in verifying client information, especially in public disclosures. Maintaining professional skepticism is essential to prevent investor harm and uphold market integrity .

SEC’s Emphasis on Audit Committees and Audit Quality (2024)

The SEC’s Chief Accountant emphasized the importance of professional skepticism and audit quality, highlighting concerns about audit committees’ potential biases due to close ties with management.

Audit committees must prioritize audit quality by supporting auditor independence and fostering rigorous skepticism. Effective oversight and frequent evaluation of audit processes are vital for maintaining high audit standards and protecting investor interests.

These cases reinforce the SEC and DOJ’s commitment to enforcing standards that uphold professional skepticism among auditors and financial advisers, ultimately safeguarding the interests of investors and maintaining the trustworthiness of financial markets.

Closing

If, as asserted at the outset, trust is indeed a professional hazard for auditors, then it follows that informed, knowledgeable skepticism is a professional asset. That principle applies not only to auditors but also to the board members and financial executives responsible for detecting and deterring fraud of all types, specifically financial reporting fraud. Companies can deter fraud and increase the likelihood of its detection by challenging their own assumptions and fostering an environment that encourages and supports such challenges.

I welcome your thoughts and comments.

Best! Jonathan M.

?

Attribution:

Jeanette M. Franzel, “Auditor Objectivity and Skepticism – What’s Next?” American Accounting Association Annual Meeting, Aug. 5, 2013, https://pcaobus.org/News/Speech/Pages/08052013_AAA.aspx“

Staff Audit Practice Alert No. 10: Maintaining and Applying Professional Skepticism in Audits,” Public Company Accounting Oversight Board, Dec. 4, 2012, https://pcaobus.org/Standards/QandA/12-04-2012_SAPA_10.pdf

“Closing the Expectation Gap in Deterring and Detecting Financial Statement Fraud: A Roundtable Summary,” Anti-Fraud Collaboration, 2013, p. 3, https://na.theiia.org/standards-guidance/Public%20Documents/Anti-Fraud%20Collaboration%20Report.pdf“

IIA Chapter 10,” “Quizlet” online study guide, 2014, https://quizlet.com/15259935/iia-chapter-10-flash-cards/

“Staff Audit Practice Alert No. 10.” Steven M. Glover and Douglas F. Prawitt, “Enhancing Auditor Professional Skepticism,” Global Public Policy Committee, November 2013, p. i, https://www.thecaq.org/docs/research/skepticismreport.pdf

Ibid.Ibid, p. ii.

The Hurtt Skepticism Scale is summarized in Rosemary Fullerton and Cindy Durtschi, “The Effect of Professional Skepticism on the Fraud Detection Skills of Internal Auditors,” Social Science Research Network, Nov. 11, 2004, https://ssrn.com/abstract=617062“

Enhancing Auditor Professional Skepticism,” p. 18.“Closing the Expectation Gap in Deterring and Detecting Financial Statement Fraud,” p. 10.

SEC Charges Two Investment Advisers with Making False and Misleading Statements About Their Use of Artificial Intelligence

Seven Lessons to be Learned from Recent SEC Enforcement Actions Involving Municipal Bond Financings

SEC Chief Accountant Urges Focus On Professional Skepticism And Audit Quality