Internal auditors are trained to ask questions. So why do governance failures still occur in organizations with mature internal audit functions, established control frameworks, experienced auditors, risk registers, audit committees, and well-documented assurance processes?
The conventional answer is that risks were missed. My research suggests something more uncomfortable.
In many cases, the risks may not have been entirely invisible. The warning signs were present. The inconsistencies were noticeable. The explanations may have sounded reasonable, but not fully convincing. The questions may even have been asked. But the challenge did not go far enough.
The internal audit profession calls this professional skepticism.
Yet despite being one of the most important safeguards against weak governance, professional skepticism remains one of the least understood capabilities in modern internal audit. Many internal auditors would struggle to identify where professional skepticism appears in the Global Internal Audit Standards, even though the Standards require auditors to exercise it throughout the audit process as a safeguard against bias, misjudgement, and overreliance on management representations.
That should give us pause. If one of the profession’s most important safeguards against weak assurance receives less attention than methodology, documentation, or compliance, perhaps we should ask why.
Professional skepticism is what makes an internal auditor pause when something appears too neat, too convenient, or too well-controlled on paper. It is the difference between confirming that a process was followed and asking whether the process still makes sense.
During more than two decades in the profession, I have worked on audits involving significant governance concerns, complex procurement environments, high-risk strategic projects, and matters that attracted board, regulatory, or public scrutiny. Looking back, what stands out is not the absence of policies, controls, or assurance activities. More often, the clues were already visible. Something did not quite make sense. An explanation felt incomplete. Yet the most difficult challenge was often not identifying the issue. It was deciding whether to push further when others were prepared to move on.
That experience led me to a question that eventually became the focus of my MBA research:
Why do experienced internal auditors who understand professional skepticism still find it difficult to apply when it matters most?
The answer may have less to do with auditors than we think.
My research suggests that the greatest barriers to skepticism are often not technical at all. They are embedded in organizational culture, leadership behavior, performance pressures, governance maturity, and the extent to which challenge is genuinely encouraged or quietly discouraged.
In other words:
Internal audit’s skepticism problem may not primarily be an internal auditor problem. It may be a governance problem.
The Research Surprise
When I began researching professional skepticism, I expected to find gaps in internal auditor knowledge, capability, or training. (By the way, there is limited research done on internal audit compared to external audit.)
I found something more interesting.
Most participants demonstrated a strong understanding of professional skepticism. They described it as maintaining a questioning mind, validating evidence, testing assumptions, and remaining alert to inconsistencies. They understood its importance to internal audit quality. They understood its role in governance. They understood that internal audit cannot simply accept management explanations without adequate challenge.
The surprise was not that auditors lacked skepticism. The surprise was how often the barriers sat outside the individual auditor.
Participants pointed to performance pressure, rigid engagement scopes, management resistance, time constraints, hierarchical norms, fear of escalation, and governance environments where skepticism was encouraged in principle but not always supported in practice. That distinction matters.
If auditors do not understand skepticism, training may be the answer. But if auditors understand skepticism and still struggle to apply it, then the problem is deeper. It means organizations may be unintentionally creating environments where skepticism is valued rhetorically but constrained behaviorally.
The Research Surprise
Auditors often understand professional skepticism. The real challenge is whether organizational culture, leadership behavior, performance systems, and governance structures allow them to apply it when the stakes are high.
We May Be Solving the Wrong Problem
When organizations identify weaknesses in internal audit quality, the response is often predictable: more training, more guidance, more methodology, more checklists. None of those interventions are wrong. But they assume the root cause is a lack of knowledge. What if the issue is not that auditors do not know how to be skeptical? What if the issue is that the organization has made skepticism difficult to exercise?
Internal auditors operate within real-world pressures. Complete the audit plan. Meet deadlines. Maintain stakeholder relationships. Avoid unnecessary escalation. Keep reports concise. Deliver value. Be collaborative. Be efficient. Individually, these expectations make sense. Collectively, though, they can create an environment where skepticism becomes increasingly uncomfortable.
No policy says, “Do not challenge management.” But the environment can send that message anyway.
Participants in the research consistently highlighted the tension between speed and depth. Internal auditors described situations where performance targets, rigid methodologies, stakeholder resistance, and organizational expectations encouraged completion over inquiry.
The consequence is subtle but important: Internal auditors learn to finish rather than probe. They learn to document rather than investigate. They learn to manage disagreements rather than test them. Professional skepticism becomes something acknowledged in standards but harder to sustain in practice.
This is where governance failures often begin. Not with a lack of information. Not with an absence of controls. But with assumptions that seem reasonable and therefore remain unchallenged.
The Most Dangerous Word in Governance
One word appears repeatedly before governance failures are uncovered: “reasonable.” Management’s explanation seemed reasonable. The control appeared reasonable. The variance looked reasonable.
Professional skepticism requires auditors to be cautious whenever reasonable becomes a substitute for verified.
Consider a procurement audit. Competitive bidding requirements have been met. Approval thresholds were respected. Documentation is complete. The audit concludes that controls are operating effectively.
A skeptical internal auditor asks different questions:
-Why do the same suppliers repeatedly appear on bid lists?
-Why are contract awards consistently just below escalation thresholds?
-Why are emergency purchases becoming more frequent?
-Why has supplier concentration increased despite competitive processes?
Professional skepticism does not mean distrusting management. Nor does it mean assuming misconduct. It means asking whether the available evidence is sufficient, whether alternative explanations exist, and whether the conclusion remains sound when challenged. That is the difference between audit as a compliance activity and audit as a governance safeguard.
Reasonable is not the same as verified.
From Auditor Competency to Governance Capability
This was perhaps the most significant implication of my research. For decades, professional skepticism has largely been viewed as an internal auditor competency. The assumption has been simple: strengthen the auditor and skepticism will improve.
My findings challenge that assumption. Professional skepticism should be viewed not merely as an auditor competency, but as a governance capability.
When skepticism is viewed as an individual trait, organizations ask: “How do we train auditors to be more skeptical?”
When skepticism is viewed as a governance capability, the questions become much more powerful:
- Do leaders model constructive challenge?
- Are difficult questions welcomed or avoided?
- Do performance systems reward insight or merely completion?
- Does the audit committee actively probe management responses?
These are not merely audit questions. They are governance questions. And they determine whether skepticism survives contact with organizational reality.
The strongest governance environments are not necessarily those with the most policies, controls, or procedures. They are the environments where challenge is normalized. Where assumptions can be questioned. Where difficult conversations are not avoided. Where internal auditors can ask uncomfortable questions without fearing personal or professional consequences.
Governance structures alone cannot achieve that. Culture must support it. Leadership must model it. Governance must protect it.
Shift the Question
Instead of asking:
“How do we make auditors more skeptical?”Ask:
“How do we create environments where skepticism can flourish?”
Internal Audit as the Governance Conscience
Internal audit is evolving. Stakeholders increasingly expect more than assurance over historical controls. They want insight, foresight, perspective, and challenge. Professional scepticism is the bridge between those expectations and audit’s ability to meet them.
Without scepticism, internal audit risks becoming a compliance mechanism that confirms what management already believes. With scepticism, internal audit becomes something far more valuable: A governance conscience. It is not designed to create tension. Rather, it is the independent voice willing to ask the difficult questions before regulators, shareholders, boards, customers, employees, or the public are forced to ask them instead.
-It challenges assumptions.
-Tests explanations.
-Looks beyond compliance.
-Questions whether outcomes make sense.
-And asks what might have been overlooked.
In many ways, this is where the future value of internal audit lies. Not merely in confirming that controls exist. But in helping organizations see risks, behaviours, assumptions, and blind spots that others may miss.
What Will You Do Differently on Monday Morning?
The next major governance failure in any organization may not occur because internal audit failed to identify a risk. It may occur because the risk was identified, discussed, rationalized or ultimately accepted without sufficient challenge. That is why professional scepticism matters. Not simply because the Standards require it. But because effective governance depends upon it.
If organizations want stronger internal audit functions, they must stop treating scepticism as something internal auditors should merely learn and start treating it as something leaders must enable, governance structures must protect, and organizational cultures must reward. Because internal audit becomes the governance conscience of an organization only when it is permitted and expected to ask the question others may prefer to avoid: What if we are wrong?
And so perhaps the most important question remaining is not what your organization should do next year, or what your audit function should do next quarter. It is much simpler: What will you do differently on Monday morning?
Will you accept an explanation because it sounds reasonable, or will you seek evidence that validates it?
Will you close an issue because it sits outside scope, or will you ask whether the wider risk has truly been understood?
Will you focus on completing the audit programme, or on understanding what the evidence is really telling you?
These moments shape audit quality. And ultimately, they determine whether internal audit merely reports on governance or acts as its conscience.
The real test of audit quality is not whether the file was complete, the report was issued, or the audit plan was delivered. It is whether, when something did not make sense, internal audit stopped long enough and pushed hard enough to ask: “Are we really sure?” 
Michelle Moodley is a senior internal audit specialist and governance professional with more than two decades of experience in complex assurance environments. She recently completed her MBA with distinction at Henley Business School Africa, where her research focused on strengthening professional scepticism among internal auditors as a governance capability.