For the past several years, most auditors in publicly traded companies had to eschew consulting assignments, as a result of the resource constraints created by the Sarbanes-Oxley Act of 2002, in order to focus on completing assurance reviews. Now, the pendulum is poised to swing in the opposite direction. Difficult economic conditions and heightened shareholder expectations are placing pressure on executive management and audit committees to improve risk management and deliver greater value. Consequently, senior managers now expect internal auditors to provide more than just assurance reviews. Specifically, executives expect performance improvement recommendations and insights into emerging risks, in addition to performing operational and regulatory compliance reviews. To satisfy executives’ expanded expectations, internal auditors need to demonstrate critical thinking, among other core competencies, when they perform their audits and consulting assignments.

Frequently, the need for “auditor judgment” is cited when drawing conclusions and forming opinions. This judgment is formed by experience and critical thinking. Inasmuch as experience is a function of time and acquired as a result of auditing diverse processes and functions, it cannot be rushed or accelerated. However, critical thinking is a mental discipline that can be learned.

Defining “critical thinking”
The ability to think critically does not mean nitpicking or being unreasonably critical, no matter how often internal auditors might be accused of such behavior by the managers of departments under review. Critical thinking is more accurately characterized as a mental framework and cognitive approach that enables practitioners to understand and effectively dissect a situation to develop conclusions. This thought process requires one to approach every audit – from start to finish – with a healthy professional skepticism.

Although some individuals have a natural proclivity for disciplined questioning and logical reasoning, critical thinking is not always an innate ability among internal auditors or other professionals. However, it is a core competency that can be acquired.

Curiosity is often the key
Critical thinking comes to some people more easily because they inherently have more curiosity than others. Curiosity is the foundation of all critical thinking activities. Effective critical thinkers demonstrate the ability to question underlying assumptions in ways that reveal new connections and sometimes lead to unexpected lines of inquiry. They are not pacified by statements like, “We have always done it this way” or “No one has ever asked about that before.” Essentially, if you are the type of person who will question why the sky is blue instead of accepting the assertions of others that it simply is and always has been, you are a critical thinker.

Critical thinking in internal audit can take the form of asking whether a given technique or line of inquiry is relevant even though it has been used successfully in the past. Why are we sampling particular transactions and what do we expect the testing to tell us? Why are we choosing the quantities and types of data points being reviewed? Is there a better way to perform testing (e.g., using audit software) even though this test has always been done in the past?

Consider using the following tips to hone your critical thinking skills when assessing audit situations and how their components interrelate:

1. Look closely at your information from different angles to see whether the different perspectives affect your conclusions or lead to new, unanswered questions
2. Look for gaps in the data you have collected and determine the effect any missing pieces will have
3. Think positively and optimistically to catalog all the benefits of the decision and spot the opportunities and value that may arise from it
4. Look at the decision cautiously and defensively to spot the weaknesses of the decision - something which comes fairly naturally for most auditors – and allow for the consideration of contingencies to counter them
5. Look at problems using intuition, gut reaction and emotion
6. Try to think of how other people will react emotionally
7. Try to anticipate the responses of people who do not fully understand your reasoning and risk assessment

Beware distortions that can impair or bias critical thinking
In the process of trying to think critically, it is also important to be aware of a number of mental potholes that diminish the effectiveness of critical thinking skills and lead to erroneous conclusions:

The Halo Effect - Overvaluing the significance of one or some positive results to arrive at a generalized impression of positive performance, which is then accepted as evidence of the efficacy of a decision, outcome or strategy. If multiple variables are not measured independently, conclusions may be susceptible to this effect.

Correlation and Causality - Accepting factors as being linked and interrelated when, in fact, relationships may be entirely coincidental in nature. Negative outcomes do not always mean that managers have made mistakes, while good outcomes are not always a manifestation of brilliance.

The Single Explanation - While it may be attractive to believe that a single factor is responsible for an outcome, it is usually a confluence of multiple factors. Beware of simplification and reductionism; things are rarely that simple. At the same time, beware of perceived complexities that can confuse and obfuscate. Things are rarely that complicated.

Rigorous Research - If the data are full of “halos,” it will not matter how much data is gathered or how sophisticated the analysis may appear to be. Any resulting conclusions will likely not jibe with the facts.

Lasting Success - Just because an organization is successful today does not mean that it will remain so indefinitely. This is because a variety of often volatile and unpredictable variables will contribute to either success or failure.

Organizational Performance - Long-term, organizational performance cannot be predicted with scientific accuracy; there will always be “wild cards” that can affect the ultimate outcomes. Long-term performance is relative, not absolute. An organization can improve and fall behind its competitors or the market at large – all at the same time.

Loss Aversion - Studies have shown that people are more averse to losses than they are to the celebration of gains of equal or greater value. Consequently, the results of bad decisions may linger well beyond the point of any legitimate benefits.

Extrapolation Bias - This is known as the tendency to believe that current trends will continue forever. The best recent example being the “irrational exuberance” over investment markets and housing values that contributed to the current financial crisis.
Special obstacles to critical thinking about risks and controls
Along with these mental potholes are other pitfalls related to the process of risk assessment. Keep these in mind when you need to discuss with management the results of your risk assessment and control evaluation:
 
The Dread Factor and Probability Neglect – The more people dread a negative outcome, the more anxious they get and the less precisely they can calculate the odds of a negative effect actually happening. Essentially, the dread impairs the ability to assess the likelihood of a risk occurring.

Catastrophic versus Slow-Steady Risk Events – Catastrophic risks, however unlikely, are perceived to be of a higher order of importance than steady or gradual risks such as climate change that may actually have more profound, long-term impact.

Habituation – Unfamiliar, new threats are perceived as scarier than familiar ones due to the human propensity to adapt to unpleasant stimuli, leading people to become less concerned than they should be about the risk.

The Comfort of Control – The level of risk may be misjudged when people believe they may have some control over it, even if the sense of control is illusory.

Optimism Bias – The convenient belief that risks that apply to other people do not apply to them.

Lure of the Comforting Percentage – People are sometimes inclined to accept as fact numbers with specificity that seems to imply a high degree of accuracy and reliability. In one such study, people were more inclined to approve of hypothetical airline safety-equipment purchases capable of saving 98 percent of 150 passengers over other hypothetical alternatives capable of saving 100 percent of 150 passengers.

The Flawed Comparison – The effect of two very different probabilities being conflated into one flawed forecast. For example, arguing that a person has a one in 250,000 chance of being hit by a falling airplane does not necessarily translate to the equivalent risk factor for those living next to airports.

The benefits of critical thinking to auditors
What do auditors gain from learning to think critically? They arrive at more substantial, comprehensive, and useful conclusions and recommendations and trigger fewer review notes from their in-charges and managers in the process.

Critical thinking is just as important at the in-charge auditor level, where decisions are made regarding the audit’s scope and determining what issues will be reported. It is also important at the manager level when making staffing decisions, determining the annual audit plan, developing budgets, and allocating the amount of time to be spent on each audit.

While the audit report is the physical outcome of an audit, its quality is directly impacted by the degree of critical thinking deployed by the audit team during the assignment. Since critical thinking is vital at all levels within internal audit, the prescient audit executive sets a tone and culture that values and rewards this competency.

Thinking about thinking
Perhaps the best way to cultivate a culture of critical thinking is simply to help staff members think about how they think. Are connections and interrelationships among audit issues not immediately apparent, but obvious when looking at the findings from different or unexpected directions? Are the auditors asking the right questions? Are they looking directly at the issues and potential solutions and not seeing them? Do they trust their gut when something does not seem right or a piece of data does not fit the anticipated pattern?

In the end, the ability to think critically, assess risk accurately, and make viable, recommendations to improve internal controls and overall risk management practices is one of the core value propositions internal auditors offer an organization. By encouraging its development, rewarding it when it appears and setting an organizational tone that values it, critical thinking can make the internal audit function more effective, efficient, and relevant at a time when the risks facing organizations are becoming more numerous and potentially costly every day.

Ann M. Butera, CRP is President of The Whole Person Project, Inc., an organizational development consulting firm. She is a frequent speaker at internal audit conferences and has worked with audit departments of all sizes to provide auditors with the tools and techniques needed to improve risk management practices within their organizations. She is a member of the IIA, the American Society for Training and Development, the Association of Government Accountants, and the National Association of Corporate Directors. She serves on the Audit Committee for a financial services firm.