Category: Internal Audit

Professional Skepticism

Also known as: Auditor Skepticism, Skeptical Attitude

Simply put

Professional skepticism is a questioning, alert mindset that auditors are expected to maintain when examining information and evidence. Rather than accepting explanations or records at face value, the auditor critically assesses what is presented and remains open to the possibility that it may be incomplete, inaccurate, or misleading. It is generally regarded as central to the value an audit provides.

Formal definition

In auditing standards, professional skepticism is defined as an attitude that includes a questioning mind and a critical assessment of audit evidence. It requires the practitioner to remain alert to conditions that may indicate possible misstatement, and to critically evaluate the sufficiency and appropriateness of evidence obtained rather than presuming that information provided by the entity is reliable. Applying an appropriate level of skepticism is a matter of professional judgment: audit guidance commonly acknowledges that the standards articulate the attitude required without prescribing a precise, universally quantified threshold for its application. This entry addresses the concept as applied within assurance engagements; it does not cover specific procedural implementation, engagement documentation requirements, or the distinct standards that vary across audit frameworks, jurisdictions, and sectors.

Why it matters

Professional skepticism is widely regarded as central to the value an audit provides. As IFAC has observed, without it an audit has little value, because the entire purpose of assurance rests on the auditor critically assessing evidence rather than simply confirming what management presents. If practitioners accept records and explanations at face value, the resulting opinion offers stakeholders little independent comfort, and the assurance function fails to distinguish itself from the management activities it is meant to examine.

Maintaining a questioning mind matters because information provided by an entity may be incomplete, inaccurate, or misleading, whether through error or intentional misstatement. Skepticism directs the auditor to remain alert to conditions that may indicate possible misstatement and to evaluate whether the evidence obtained is sufficient and appropriate, rather than presuming reliability. This alertness is what enables an assurance engagement to surface issues that the entity's own controls or representations might otherwise obscure.

Because applying an appropriate level of skepticism is a matter of professional judgment, its consistent exercise is also a recurring focus of audit quality discussion. Audit standards articulate the attitude required but, as noted in guidance from sources such as ACUA and the INTOSAI Journal, do not prescribe a precise, universally quantified threshold for its application. This leaves the calibration of skepticism to the practitioner's judgment, making it both a defining strength of the profession and an area that demands ongoing attention.

Who it's relevant to

External Auditors

For practitioners performing assurance engagements, professional skepticism is a foundational expectation of the audit standards under which they work. It shapes how they evaluate audit evidence, remain alert to possible misstatement, and exercise judgment about whether the evidence obtained is sufficient and appropriate to support their conclusions.

Internal Auditors

Internal audit functions apply a comparable questioning mindset when assessing information and controls, critically evaluating what management presents rather than accepting it at face value. Doing so supports the independence and objectivity that distinguish assurance work from the management activities being examined.

Public Sector Auditors

As reflected in guidance from the INTOSAI Journal, public sector auditors are also expected to bring a questioning mind and critical assessment of audit evidence to their work, applying skepticism as a matter of professional judgment given the absence of a single quantified threshold in the standards.

Audit Stakeholders and Governance Bodies

Those who rely on audit opinions, including audit committees, boards, and other users of assurance, have an interest in professional skepticism because it is closely tied to the value an audit provides. Its consistent exercise underpins the credibility of the assurance they depend upon for oversight.

Inside Professional Skepticism

Questioning Mind

A disposition to inquire and challenge rather than accept assertions at face value, involving alertness to conditions that may indicate misstatement, error, or fraud.

Critical Assessment of Evidence

The evaluation of the sufficiency and appropriateness of audit or review evidence, including consideration of whether evidence is corroborative or contradictory and whether its source is reliable.

Suspension of Judgment

Refraining from reaching a conclusion until adequate evidence has been gathered and evaluated, avoiding premature acceptance of management representations.

Independence and Objectivity Linkage

Professional skepticism is commonly exercised by assurance functions, such as internal or external audit, and depends on the objectivity that distinguishes assurance activities from the management activities being examined.

Awareness of Bias

Recognition of cognitive biases and undue reliance on prior experience or relationships that may impair impartial evaluation of information.

Common questions

Answers to the questions practitioners most commonly ask about Professional Skepticism.

Is professional skepticism the same as assuming that management is dishonest?

No. Professional skepticism is a questioning mindset and a critical assessment of evidence; it does not presume dishonesty or bad faith. It typically means neither assuming management is honest nor assuming management is dishonest, but instead maintaining an attitude that recognizes the possibility of material misstatement or noncompliance and evaluating evidence accordingly. Treating it as an accusation of dishonesty misrepresents the concept.

Does exercising professional skepticism guarantee that errors, fraud, or noncompliance will be detected?

No. Professional skepticism reduces the risk of accepting inappropriate or insufficient evidence, but it does not guarantee detection. Assurance activities generally provide reasonable, not absolute, assurance, and limitations such as collusion, concealment, and the inherent constraints of sampling and evidence remain. Skepticism improves the quality of judgment rather than eliminating the possibility of undetected issues.

How can professional skepticism be applied when evaluating evidence provided by management?

It is commonly applied by considering whether evidence is sufficient and appropriate, corroborating representations with independent or third-party information where practicable, and being alert to evidence that contradicts or is inconsistent with other information obtained. Practitioners often probe explanations rather than accepting them at face value, particularly for matters involving significant judgment or estimation.

How should professional skepticism be documented in the course of an engagement?

Documentation typically records the questions raised, the evidence examined, any inconsistencies identified, and the rationale for conclusions reached, so that the reasoning behind judgments is transparent and reviewable. This publication does not prescribe a specific documentation format, which may vary by framework, engagement type, and applicable professional standards.

What conditions can undermine or erode professional skepticism in practice?

Common threats include time and budget pressures, over-familiarity arising from long-standing relationships, unconscious bias toward confirming prior conclusions, and excessive reliance on the competence or integrity of the party providing information. Recognizing these threats is often supported by supervision, review, and independence safeguards, though specific measures depend on the applicable standards and context.

Does professional skepticism apply only to external auditors?

No. While it is closely associated with external audit standards, a questioning and critical mindset is also relevant to internal audit and other assurance functions, and elements of it may inform second line monitoring and review activities. The independence and objectivity expectations attached to skepticism generally differ across assurance and management roles, so the manner of application varies with the function.

Common misconceptions

Professional skepticism means assuming management is dishonest.

Professional skepticism typically involves neither assuming honesty nor dishonesty; it is a neutral, questioning posture that neither presumes fraud nor accepts assertions without appropriate evidence.

Professional skepticism is only relevant to external financial statement auditors.

While closely associated with auditing, a skeptical mindset may be applied across assurance and, more broadly, second and third line activities such as internal audit and risk review, though its formal expectation is strongest in assurance functions.

Applying professional skepticism guarantees that errors or fraud will be detected.

Professional skepticism can reduce the likelihood that misstatements go unchallenged, but it does not guarantee detection, as inherent limitations exist in any assurance or review process.

Best practices

Maintain a questioning mind throughout an engagement and avoid concluding before sufficient and appropriate evidence has been evaluated.

Critically assess the reliability of the source of evidence and seek corroboration for significant management representations rather than accepting them at face value.

Remain alert to information that contradicts other evidence and follow up on inconsistencies rather than resolving them by assumption.

Guard against cognitive bias and undue reliance on prior experience or established relationships when evaluating information.

Preserve the independence and objectivity that underpin skepticism by keeping assurance activities distinct from the management activities being examined.

Document the basis for judgments and the evidence relied upon so that conclusions can be supported and reviewed.