Professional skepticism: A critical element of the COVID-era audit

The ways we work, communicate and connect have greatly evolved thanks to innovations that make it possible for organizations to operate in a more efficient and rapid manner. COVID-19 has pushed more organizations to adopt technology, presenting new challenges for auditors, especially when practicing and being professionally skeptical about audit evidence.

Concern about auditors’ application of professional skepticism has been a recurring theme in audit inspection findings globally and a key issue in discussions about audit quality. The American Institute of CPAs’ Auditing Standards Board believes it is very important that the audit, as well as the audit standards under which audits are performed, are relevant in today’s world and address how emerging tools and techniques impact the evaluation of audit evidence.

The ASB recently finalized SAS 142 on audit evidence, addressing audit regulator concerns that a lack of professional skepticism is a leading cause of audit deficiencies. The ASB is keenly aware that auditors are more likely than ever before to use information obtained from external sources as audit evidence, and SAS 142 includes examples of the use of automated tools and techniques to obtain information to be used as audit evidence. SAS 142 also establishes multi-faceted considerations of the attributes and factors used in evaluating audit evidence, regardless of source and how the auditor acquired the information.

Skepticism in context

What is professional skepticism in the context of an audit?

It is a mindset where an auditor does not simply accept information or audit evidence at face value. Rather, the auditor applies a reasonably questioning attitude while performing the audit. US GAAS (AU-C Section 200) officially defines it as an attitude that includes a questioning mind, being alert to conditions that may indicate possible misstatement due to fraud or error, and a critical assessment of audit evidence.

For example, management may send its auditor responses to inquiries that corroborate information previously provided or provide new information. In some cases, a response might provide contradictory information. When faced with potentially contradictory information, an auditor applying professional skepticism may find it necessary to modify or perform additional audit procedures.

Conducting audit procedures remotely in the midst of the pandemic is another example. The ASB standards are fit for purpose, allowing auditors to use the new technology and techniques necessary for remote work situations. The new audit evidence standard (SAS 142) sharpens auditors’ professional skepticism by expanding the considerations that should be made regarding the reliability of evidence provided electronically, reflecting the current business environment.

The role of bias

Professional skepticism, audit evidence and bias go hand-in-hand. A strong application of professional skepticism enhances auditors’ awareness of bias and their willingness to address unconscious bias. The auditor also should be aware that information produced internally by the entity is subject to management bias.

According to SAS 142, examples of unconscious auditor biases that may impede the maintenance of professional skepticism include the following:

• Automation bias, a tendency to favor output generated from automated systems, even when human reasoning or contradictory information raises questions about whether such output is reliable or fit for purpose.
• Availability bias, a tendency to place more weight on events or experiences that immediately come to mind or are readily available than on those that are not.
• Confirmation bias, a tendency to place more weight on information that corroborates an existing belief than information that contradicts or casts doubt on that belief.
• Overconfidence bias, a tendency to overestimate one's own ability to make accurate assessments of risk or other judgments or decisions.
• Anchoring bias, a tendency to use an initial piece of information as an anchor against which subsequent information is inadequately assessed.

In our current pandemic environment, auditors should be especially concerned with availability bias (i.e., not just accepting information that is easiest to obtain) and automation bias (i.e., much evidence obtained may be in digital form).

Auditors should also be aware of the risks that bias creates when dismissing contradictory information simply on the basis that it may be less reliable than corroborative information. This is critical when contradictory information comes from external sources and corroborative information is generated internally.

Inside SAS 142

How do auditing standards enhance auditors’ ability to exercise professional skepticism?

Simply including a separate section in an audit standard labeled “professional skepticism” or merely sprinkling the words “professional skepticism” throughout is not enough to achieve audit quality.

In July the ASB issued the audit evidence standard, SAS 142, which enhances the auditor’s assessment of whether information obtained constitutes sufficient and appropriate audit evidence and establishes a multi-faceted consideration of attributes and factors in evaluating such information.

The standard addresses:

• The application of professional skepticism;
• Emerging technologies used by both preparers and auditors;
• The expanding sources of information to be used as audit evidence; and,
• The relevance and reliability of audit evidence.

In the context of requiring auditors to obtain sufficient, appropriate audit evidence, SAS 142 strengthens the application of professional skepticism in three specific ways.

First, it requires that the auditor, in forming conclusions about whether sufficient appropriate audit evidence has been obtained, evaluate the relevance and reliability of information to be used as audit evidence — notwithstanding the source (internal or external) of the information, or the methods used to obtain the evidence. SAS 142 then lays out four specific attributes of “reliability” of information that the auditor is required to consider:

• Accuracy;
• Completeness;
• Authenticity; and,
• Risk of bias.

The last two attributes are new to the audit evidence standard and are aimed at enhancing the application of professional skepticism. With the expanding use of external information sources, auditors’ consideration of the information’s authenticity, and whether bias exists in the information, is becoming critically important. SAS 142 continues to acknowledge that an audit performed in accordance with GAAS rarely involves the actual authentication of documents, nor is the auditor trained as, or expected to be, an expert in such authentication.

Next, SAS 142 recognizes the increasing sources of information used by preparers and auditors in today’s business world. It allows the auditor to obtain information not previously readily available and to use information from various sources to confirm or refute assertions or statements made by company management.

For example, emerging technologies and automated tools and techniques make obtaining information easier and less time-consuming. They can also be used to better analyze increased volumes of information obtained from different sources to spot unusual relationships that warrant further questions to be asked.

Lastly, SAS 142 explicitly requires the auditor to consider all information obtained, whether corroborative or contradictory in nature, when forming conclusions about whether the auditor has obtained sufficient and appropriate audit evidence. The equal consideration of both contradictory and corroborative information is a new feature of SAS 142 but the new SAS does not change the current standards under which the auditor is not required to proactively seek out contradictory information.