Professional scepticism in internal audit: how to judge evidence

Professional scepticism means keeping confidence aligned to evidence. In internal audit, it involves testing assumptions, weighing information that supports and challenges a conclusion, and explaining what remains uncertain before making a recommendation.

A confident explanation can help you understand a process. To rely on it, you still need to establish what happened, what the information covers and whether it supports the judgement you are being asked to make.

Use this field guide when reviewing a working paper, assessing a control, considering action closure or preparing advice for a decision-maker.

What makes audit evidence useful?

Start with the claim. “The control is documented”, “the control operated” and “the control is effective” are different claims. They need different support.

A signed procedure can show an agreed design. A completed record may show one instance of operation. A conclusion about effectiveness needs evidence that addresses the control's purpose, the relevant period and the risk it is intended to manage.

Ask three practical questions:

• Relevant: does this information address our audit objective and the claim being made?
• Reliable: where did it come from, how was it produced and what checks support its accuracy and completeness?
• Sufficient: taken together, does the evidence support this conclusion, or is there a gap that could change it?

A system report may be useful, but first understand its filters, population and data quality. Several documents repeating the same unsupported assertion do not become independent corroboration. More evidence only helps when it adds something that matters.

The IIA's Global Internal Audit Standards address professional scepticism in Standard 4.3 and evidence quality in Standard 14.1. The five questions below are BTL's practical tool for applying that discipline. Read the Standards.

How do I apply the Five-Question Scepticism Check?

Use these five questions before settling an important judgement.

1. What are we assuming?

Write down what you are treating as true. Are you assuming a successful demonstration represents normal operation? That an experienced manager would notice an exception? That a reported completion percentage covers the highest-risk work?

An assumption can be reasonable. Make it visible so the team can decide whether it needs testing.

2. What evidence supports and contradicts the conclusion?

Identify the strongest support for your view and the information that weakens it. Explain the weight you give each item.

A high training-completion rate may support a statement about attendance. It gives limited support for a claim that staff can apply a difficult process under pressure. Match the evidence to the claim.

3. What would need to be true for us to be wrong?

Test an alternative explanation. What if the sample missed the busiest period? What if the apparent exception has a legitimate cause? What additional evidence would change your view in either direction?

This question helps teams test emerging concerns as carefully as emerging reassurance.

4. What pressure or bias may be influencing our judgement?

Notice deadlines, prior commitments, hierarchy and personal investment. A team may feel pressure to preserve an earlier positive rating, close an old action or avoid delaying a project.

Record the pressure and consider its effect. Pressure deserves attention, but does not itself establish that someone's explanation is wrong.

5. Has everyone who sees it differently had a genuine opportunity to speak?

Invite challenge before announcing the final view. Ask quieter colleagues what they see, and give them time to explain the evidence behind it.

If the team agrees quickly, spend two minutes making the strongest alternative case. Decide whether the original view still holds.

What does this look like in practice?

Consider this hypothetical action-closure review.

A finance manager says a monthly supplier-reconciliation control is now working. The action tracker is green. The team has a revised procedure, training records and one completed reconciliation. Three months of operation were expected before closure.

The procedure supports the design change. The completed reconciliation provides evidence for one month, subject to checking its quality. The green tracker records a status. The remaining two months have not been evidenced.

You cannot yet support the claim that the control operated consistently across all three months. You also cannot conclude from the missing records alone that the reconciliations never happened. If retaining those records is a control requirement, assess that evidence-retention issue separately.

A useful recommendation might be:

“Keep the action open while Finance provides the remaining two months of reconciliation and review evidence. The first month supports progress, but the evidence currently available does not support closure across the agreed period. The Finance Manager will provide the records by the agreed date, and Internal Audit will assess them before confirming closure.”

If the records then reveal unresolved differences, assess what those differences mean. If they support effective operation, update the conclusion. Scepticism should allow confidence to increase as well as decrease.

How should I communicate uncertainty?

State the conclusion you can support, the evidence carrying most weight and the uncertainty that matters. Then explain its consequence and the next action.

Distinguish a supported conclusion, conditional support, insufficient evidence to conclude and evidence of an adverse condition. Avoid using a vague caveat to disguise an unsupported positive opinion.

Any condition needs an owner, timing and a way to establish whether it has been met. Make clear who decides and who owns the business risk. Internal Audit's recommendation does not transfer management's responsibility to the audit team.

How can a team build the habit?

At your next file review, choose one important conclusion. Spend ten minutes answering the five questions before editing the wording.

Ask the reviewer to trace the conclusion back to its evidence, identify the strongest challenge and explain what would change their view. Agree one specific improvement to the work or reasoning. Revisit it in the next review.

Common questions

Does missing evidence mean a control failed?

Missing evidence limits what you can support. Establish whether the issue concerns control operation, documentation, retention or access to records, and report the distinction clearly.

How much evidence is enough?

Enough to support the specific conclusion at the required level of confidence, considering risk, scope, period and quality. A fixed document count cannot answer that question.

Can professional scepticism be developed through training?

Teams can practise it through cases, evidence debates and structured reviews, then apply the questions to their work. Review the quality of reasoning and application; attendance and confidence scores alone do not establish better audit judgements.

Strengthen evidence judgement across your team

Beyond the Lines helps audit, risk and controls teams practise evidence challenge and review judgement through realistic case exercises.