Professional Skepticism: The Auditor’s Questioning Mind

A credible explanation is a starting point for inquiry, not an automatic conclusion.

A receiving record shows goods arriving on Friday. The system records them on Monday. The process owner says it is a timing difference. That may be correct. An internal auditor can explore the explanation respectfully while checking what actually happened.

Curiosity with discipline

The IIA's Global Internal Audit Standards place professional skepticism within planning and performing internal audit work. Standard 4.3 calls for an inquisitive approach, critical assessment of reliability, candid questions about inconsistencies and further evidence when information is incomplete or misleading. Standard 14.1 connects the work to relevant, reliable and sufficient information.

For the practitioner, the challenge is to make those principles visible in everyday decisions. A friendly conversation need not weaken a test. A confident answer need not end it. Equally, an unusual record does not establish dishonesty.

An illustrative receiving-date discrepancy

Start by defining the claim: did the goods physically arrive on Friday, was the receipt approved then, and when should the system have recorded it under the actual process rules? Different events may legitimately have different timestamps.

Next, trace the records to their origins. An original delivery note, receipt log and posting history may answer different parts of the question. Inspect how dates are created or amended and whether a report reflects the event date or the extraction date. Three spreadsheets copied from one underlying record are not three independent confirmations.

Ask what would support or weaken the timing explanation. Weekend processing, a scheduled interface, an incomplete receipt or a manual amendment are possible hypotheses to test, not findings to assume. Compare evidence supporting the explanation with evidence that challenges it. Select further procedures and the relevant population in proportion to the risk and engagement scope; this example is not a prescribed audit program.

If the evidence supports normal processing, acknowledge that result. If it points to a departure from the agreed criteria, assess the departure and its significance. If the information remains insufficient, make the limitation visible and agree further work or escalation with the engagement supervisor. Do not turn uncertainty into an allegation to create a tidy ending.

Six questions that improve the work

• What exactly is being claimed, and against which criteria?
• Where does the explanation disagree with the records or observed process?
• How reliable is the information, and what controls affect it?
• What relevant support comes from a genuinely different origin?
• What alternative explanation could change my interpretation?
• What evidence and reasoning justify the conclusion, and what remains unresolved?

These are Inside Assurance practitioner prompts, rather than a standardized checklist. Their value comes from the reasoning behind each answer.

A questioning mind also tests its own story

Financial-statement auditing offers a useful comparison. ASA 200 discusses contradictory evidence and explains why prior experience of management's honesty does not remove the need for persuasive support. That standard concerns financial-statement audits; the internal-audit foundation here is the IIA framework.

An explanation can itself provide useful information. Its adequacy depends on the claim, the risk and the support available. More pages do not necessarily resolve a reliability problem, and more suspicion does not necessarily produce a better judgment.

A sound workpaper makes the path visible: the question, the criteria, the information considered, the tests performed, competing explanations, the conclusion and any limitations. The reader should be able to follow why the auditor changed their mind—or why the initial explanation remained credible.

Be curious about the explanation. Be disciplined about the evidence.