A Bit More on That Skepticism Thing . . .
OCIE director Lori Richards isnít the only one out there recommending an attitude of professional skepticism. As it turns out, "professional skepticism" is a long-accepted professional standard in the auditing world.
Check out this discussion from a PCAOB auditing standard about how auditors should kick the tires to detect fraud:
"Because of the characteristics of fraud, the auditorís exercise of professional skepticism is important when considering the risk of material misstatement due to fraud. Professional skepticism is an attitude that includes a questioning mind and a critical assessment of audit evidence. The auditor should conduct the engagement with a mindset that recognizes the possibility that a material misstatement due to fraud could be present, regardless of any past experience with the entity and regardless of the auditorís belief about managementís honesty and integrity. Furthermore, professional skepticism requires an ongoing questioning of whether the information and evidence obtained suggests that a material misstatement due to fraud has occurred. In exercising professional skepticism in gathering and evaluating evidence, the auditor should not be satisfied with less-than-persuasive evidence because of a belief that management is honest."
In light of the strong response from some in the industry to her April 20 speech, IM Insight asked Richards if she wanted to say anything else on the skepticism topic.
"I believe that one does not have to look too far back into history and experience to understand why compliance professionals should exercise Ďprofessional skepticismí in their work, including by imagining the ways in which laws and rules could be subverted," Richards said in a statement. "While a compliance person should always seek to establish excellent working relationships with business line staff, including relationships that encourage business staff to come to compliance staff with questions and issues as they arise, they cannot be blind to the fact that this dynamic may not be the case with all organizations or all firm employees."
Richards pointed out that individuals bent on fraud may be rather creative. And, she added, "they are not likely to seek out compliance staff for consultation!" Compliance staff, she said, "need to be alert to and indeed to imagine ways that the rules may be subverted so that they can attempt to ensure that compliance and supervisory practices cover these new areas. A healthy skepticism should also cause them to verify assertions, consider competing incentives, and be alert to contrary indications."
And what does Shearman & Sterling partner Barry Barbash think about the skepticism topic?
"Fundamentally, I agree with the sentiment underlying [Richardís speech]," said Barbash. He added that being skeptical doesnít mean that a compliance officer must function in an independent state, "living in an island separate and apart from management." In most instances, he noted, the interest of the CCO and the company that employs him "will be the same."
To be effective, said Barbash, compliance systems should be headed with someone with "enough confidence and enough independence to make the hard calls" and challenge procedures "that just donít work."