Category: Internal Audit

Due Professional Care

Simply put

Due professional care is the principle that auditors and similar professionals should carry out their work with the competence, diligence, and skill that a reasonably prudent and capable practitioner would apply. It commonly requires that the professional remain objective and independent and follow the standards established for their profession. It sets an expected standard of conduct rather than guaranteeing that every audit will detect all issues.

Formal definition

In internal audit and assurance practice, due professional care denotes the care and skill expected of a reasonably prudent and competent internal auditor when planning and performing engagements. As reflected in IIA guidance associated with Standard 1220 (and referenced in the more recent Standard 4.2), it obliges practitioners to apply professional competence and diligence appropriate to the engagement while conducting work in accordance with applicable professional standards. In the external audit context it is commonly linked to the requirements for objectivity and independence, meaning the practitioner should be free of relationships or biases that could impair judgment. Due professional care is a standard of conduct and reasonable diligence; it does not, on its own, assure that all errors, misstatements, or irregularities will be identified. This entry does not address specific engagement procedures, jurisdiction-specific auditing rules, or the detailed clause requirements of any particular standard-setter.

Why it matters

Due professional care establishes the benchmark against which the quality and defensibility of assurance work is judged. When an internal auditor or external auditor exercises the competence, diligence, and skill of a reasonably prudent practitioner, stakeholders can place greater reliance on the resulting conclusions. Where that standard is not met, findings may be challenged, and the credibility of the assurance function can be undermined. Because due professional care is a standard of conduct rather than a guarantee of outcomes, it frames what can reasonably be expected of a practitioner without implying that every error, misstatement, or irregularity will be detected.

The principle also underpins the objectivity and independence that distinguish assurance activities from the management activities they examine. As reflected in guidance associated with the profession, due professional care commonly requires the practitioner to remain free of relationships or biases that could impair judgment. This distinction matters because assurance loses value when the person providing it is not sufficiently detached from the process, control, or function being evaluated. Diligence without independence, or independence without competence, would each fall short of the expected standard.

For governance bodies and audit committees, due professional care is significant because it shapes how much weight they can reasonably attach to assurance reports when making decisions. It sets an expectation of reasonable diligence conducted in accordance with applicable professional standards, while making clear that it does not, on its own, assure the discovery of all issues. Understanding this boundary helps organizations avoid over-relying on any single engagement as a complete safeguard.

Who it's relevant to

Internal auditors

Internal auditors are directly subject to the expectation of due professional care, as reflected in IIA guidance associated with Standard 1220 and referenced in the more recent Standard 4.2. They are expected to apply the competence, diligence, and skill of a reasonably prudent and competent practitioner when planning and performing engagements, and to conduct their work in accordance with applicable professional standards.

External auditors and assurance providers

In the external audit context, due professional care is commonly linked to objectivity and independence. Practitioners are expected to carry out audits in accordance with the standards set for the profession and to remain free of relationships or biases that could impair judgment. The principle sets the expected standard of conduct without guaranteeing that every issue will be detected.

Audit committees and governance bodies

Those charged with governance rely on assurance work performed with due professional care when weighing the credibility of findings. Understanding that the principle establishes reasonable diligence rather than a guarantee of complete detection helps these bodies calibrate how much reliance to place on any single engagement.

Compliance and risk professionals

Compliance officers and risk managers who receive or commission assurance benefit from understanding that due professional care governs how that assurance is expected to be performed, including the objectivity and diligence applied. This helps them interpret assurance conclusions appropriately without treating them as an assurance that all errors or irregularities have been identified.

Inside Due Professional Care

Reasonable Care Standard

The expectation that a practitioner applies the skill, diligence, and judgment that a reasonably prudent and competent professional would exercise in comparable circumstances. It is a standard of conduct and effort, not a guarantee of a particular outcome.

Professional Competence

The requirement that the practitioner possesses, or obtains through supervision or consultation, the knowledge and skills needed for the engagement. Due professional care presumes an appropriate level of competence before work is undertaken.

Professional Skepticism

An attitude of questioning mind and critical assessment of evidence, commonly associated with assurance and audit functions. It supports objective evaluation rather than uncritical acceptance of information provided by management.

Diligence and Thoroughness

Attention to the scope, materiality, and complexity of the work, including gathering sufficient appropriate evidence and following applicable standards and procedures throughout the engagement.

Sound Judgment

The application of informed, reasoned decision-making in planning, execution, and reporting, including recognizing when to escalate, consult, or extend procedures.

Alignment with Applicable Standards

The exercise of care consistent with recognized professional standards and frameworks relevant to the function; the specific articulation of due care may vary by profession, standard-setting body, and jurisdiction.

Common questions

Answers to the questions practitioners most commonly ask about Due Professional Care.

Does exercising due professional care guarantee that an auditor will detect all errors, fraud, or control failures?

No. Due professional care describes the level of diligence, competence, and reasonable skill expected of a prudent professional; it does not guarantee that every misstatement, irregularity, or control deficiency will be found. Assurance engagements are typically conducted on a sample or risk-focused basis and are subject to inherent limitations, so care is measured by the appropriateness of the effort and judgment applied rather than by the outcome achieved.

Is due professional care the same as professional skepticism?

They are related but distinct. Professional skepticism refers to a questioning mindset and critical assessment of evidence, and it is one component that supports the exercise of due professional care. Due professional care is the broader standard of diligence and competence expected across the whole engagement, encompassing planning, evidence gathering, judgment, and reporting. Skepticism is an attribute that contributes to care, not a synonym for it.

How can an assurance professional demonstrate that due professional care was exercised on an engagement?

Care is commonly evidenced through documentation of the work performed, including the basis for scoping decisions, the nature and extent of procedures, the evaluation of evidence, and the reasoning behind significant judgments and conclusions. Contemporaneous working papers that show how conclusions were reached typically provide the clearest support that appropriate diligence and competence were applied.

Does due professional care require the same level of effort on every engagement?

Not necessarily. The extent of work consistent with due professional care commonly varies with factors such as the complexity, materiality, and risk of the subject matter, the objectives of the engagement, and the reliance others may place on the results. A prudent professional typically calibrates the depth of procedures to these factors rather than applying a uniform effort regardless of context.

How does maintaining professional competence relate to due professional care?

Competence is generally treated as a foundation for due professional care. Applying reasonable skill assumes the practitioner possesses, or obtains, the knowledge relevant to the subject matter. Where specialized expertise is required, care may involve engaging or consulting appropriately qualified specialists rather than proceeding beyond one's own competence, and maintaining current knowledge through ongoing professional development supports the standard over time.

What is the relationship between due professional care and reliance on the work of others?

When an assurance professional relies on the work of internal specialists, other auditors, or external experts, exercising due professional care commonly includes assessing the competence, objectivity, and appropriateness of that work rather than accepting it without evaluation. The degree of review typically reflects the significance of the work relied upon to the overall conclusions.

Common misconceptions

Due professional care guarantees that errors, fraud, or misstatements will be detected.

Due professional care is a standard of effort and conduct, not an assurance of a specific result. Even when care is properly exercised, the inherent limitations of any procedure mean some issues may go undetected.

Due professional care and professional skepticism are the same thing.

Professional skepticism, a questioning mind and critical assessment of evidence, is one component that supports the exercise of due professional care, but due care is a broader concept encompassing competence, diligence, and judgment as well.

Due professional care demands perfection or infallible judgment.

The standard is what a reasonably prudent and competent professional would do in similar circumstances. It accommodates the exercise of reasonable judgment and does not treat every error made in good faith as a failure of care.

Best practices

Confirm that the practitioner or team possesses the necessary competence for the engagement, and arrange appropriate supervision or consultation where gaps exist.

Apply professional skepticism by critically assessing evidence and questioning information rather than accepting assertions at face value.

Plan and scope work in proportion to the materiality, complexity, and risk involved, and adjust procedures as circumstances change.

Document the judgments made, the evidence gathered, and the basis for conclusions to demonstrate that care was exercised.

Follow the professional standards and frameworks applicable to the relevant function and jurisdiction, recognizing that their specific requirements may differ.

Escalate or extend procedures when evidence is insufficient, inconsistent, or indicative of heightened risk.