When you ask any Chief Audit Executive about the most important attributes they look for when hiring or want from their team, critical thinking usually tops the list.

However, in 2024, many accomplished professionals can increasingly get by without critical thinking.

This includes performing standardized work like SOX control testing, easily obtaining sample templates and audit programs for new areas, and—perhaps most notably—using generative AI to determine what and how to audit by simply typing "how to audit xyz" into a GenAI application.

Today, I wanted to provide a brief overview of critical thinking in Internal Audit: what it means, why it matters for team success, two common areas where it can be applied during audit projects, and how to strengthen your team's critical thinking abilities.

What is Critical Thinking

Critical thinking is a disciplined process of assessing, analyzing, and scrutinizing all available information—rather than relying on easily accessible data or obvious answers—to reach reasoned conclusions and make thoughtful decisions.

In internal audit, critical thinking means looking beyond surface-level data to identify trends, patterns, and relationships. This approach helps us understand why processes exist, what causes controls to fail, and how to create meaningful recommendations for risk management, process improvement, and resource allocation.

The Importance of Critical Thinking in Internal Audit

Without critical thinking, internal audit can devolve into a mechanical "check-the-box" exercise. While surface-level approaches to auditing might catch procedural deficiencies, it fails to deliver actionable insights or meaningful recommendations.

Generic recommendations in Internal Audit reports like "the business needs more training" or "a manager needs to perform a more thorough review" can signal a lack of critical thinking and analysis.

Critical thinking, by contrast, enables auditors to contextualize findings, prioritize risks, and contribute more effectively to their company's success through enhanced assurance.

With critical thinking at its core, internal audit becomes a function that enhances decision-making, strengthens governance, and drives organizational performance.

Critical thinking is a powerful tool that can redefine Internal Audit's reputation and enhance its credibility. Key leaders who rely on audit's work appreciate when they see evidence of deeper, more sophisticated analysis in the information presented to them.

Applying Critical Thinking in Internal Audit

While critical thinking can be applied throughout audit projects and function management, I want to highlight two areas where Internal Audit teams often have the greatest opportunity to enhance their critical thinking skills.

Planning and Scoping an Audit Project

A key principle of critical thinking is gathering and analyzing comprehensive information before making decisions. In my experience, Internal Auditors have significant room for improvement in this area when defining audit project scope.

When planning, too many internal auditors limit themselves to a rigid "document process—identify the risk—test the control" mindset.

While this approach may help evaluate control effectiveness, it does little to determine whether the process design and controls being tested are truly adequate to support your company's success.

Rather than taking this rigid approach, expand your review scope when planning an audit from scratch. Consider reviewing the following types of documentation alongside your process understanding to create a more targeted audit program:

• How the process aligns with company goals, objectives, and risks
• Current industry trends and process best practices
• External subject matter expertise and industry knowledge
• Maturity of the people, process, and technology involved
• Input from key second- and third-line leaders
• Focus areas identified by the leaders of the audited department
• Previous audit scopes and findings from similar engagements

Exploring alternative information sources can reveal both new ways to test existing controls and opportunities to evaluate whether the current process needs enhancement through changes in people, processes, or technology to better meet management's expectations.

Determining if Testing Observations are Issues

Critical thinking particularly helps traditional or compliance-based Internal Audit teams evaluate whether testing observations truly represent significant issues.

Historically, when fieldwork testing reveals deviations from control procedures, these observations are typically recorded as issues. Their ratings are then assessed based on both their actual and potential impacts.

Control activities are not isolated elements—they are components of the broader internal control environment. Internal auditors should think critically about whether the overall strength of the control environment might minimize the impact of an individual control deficiency.

For example, before making the decision to report the observation as an issue, can the internal audit team evaluate other aspects of the area being audited, including:

• the tone at the top of the area being audited, and management's capability and competence
• if and how risk is identified and managed
• the reliability of data entering and exiting the process
• how relevant information is communicated internally and externally
• how the auditable entity self-monitors and remediates self-identified issues?

Armed with this information, the Internal Audit team may find that the previously identified issue may not have as much impact, with the other components of Internal Control operating effectively, and decide not to report an item of insignificance.

Practicing Critical Thinking in Internal Audit

Critical thinking isn't an innate skill—it can be learned and should be cultivated within audit teams. There are numerous concepts and approaches to critical thinking worth exploring.

Dedicate formal time for critical thinking in each audit project

Internal Audit managers and leaders should lead dedicated discussions during audit projects—particularly before completing scoping and fieldwork. These conversations allow team members to openly discuss project scope, challenge assumptions, examine biases, share their interpretation of data, and present relevant research that can strengthen the audit process.

Many larger audit teams regularly schedule dedicated time with their CAE for these discussions—both before finalizing audit scope and before issuing draft reports.

Adding these meetings to your work plan and documenting this practice in your audit methodology can ensure the team consistently applies critical thinking to each audit.

Additionally, templates and checklists covering critical thinking concepts can be embedded in your audit software to guide auditors and encourage analytical thinking.

Create awareness and celebrate “what good looks like”

When team members discover valuable insights that reshape an audit's direction, suggest creative approaches to evaluate data and controls, or develop recommendations that demonstrate deep problem analysis, the audit management team and CAE should celebrate these achievements.

Showcasing examples of excellence in audit project debriefs, recognizing these achievements during team meetings, and building a library of "critical thinking in action" examples will motivate auditors to analyze their assurance work more thoughtfully.

Reinforcing these wins while providing constructive feedback—especially when auditors rely on generic information or fail to consider alternative perspectives—can drive more critical thinking across your team and elevate the quality of your team's work.

The Critical-Thinking Internal Audit Team

There has never been a better time for Internal Audit teams to succeed. Their ability to provide deeper analysis will serve as the catalyst to transform their organizational reputation and achieve greater impact.

CAEs who create an environment and dedicate time for deeper research, analysis, scrutiny, and review are preparing their teams to enable positive change within their organizations.