Professional skepticism: An auditor's defense against manipulation tactics

A recent study of fraud offenders suggests they often employ impression management tactics in their interactions with auditors to conceal fraud schemes in financial documents. But auditors have an indispensable tool to defend against these tactics: professional skepticism. The author details the findings of the study and describes how having a skeptical mindset can help auditors beat fraudsters at their game.

Barry Webne perpetrated a relatively simple scheme as the controller for a manufacturing firm in the 1990s by setting up a shell company and directing payments to himself. Years after his conviction for embezzlement and serving a stint in prison for the scheme, Webne refashioned himself as an anti-fraud consultant. He offered his “expertise” to advise companies on fraud prevention and spoke to groups about white-collar crime. In a 2007 lecture at the University of Cincinnati, he was forthright about his crime, stating, “I stole $1.25 million over a period of four years, and the auditors didn’t catch it.” He told the audience that his new mission was to “educate people about how easily fraud crimes can be committed and how to prevent becoming a victim.”

Little did the audience know that Webne’s newfound mission was a façade, and he used his anti-fraud consultancy to facilitate fraud against businesses seeking his advice. Companies gave Webne access to their internal controls, and he repeated the embezzlement scheme that originally sent him to prison. As he’d later say in a 2006 interview with the Association of Certified Fraud Examiners (ACFE), “If you put me in a position of trust again, chances are I am going to violate that trust.”

At a Cleveland, Ohio, ACFE Chapter event in 2007, Webne described his ability to manipulate and deceive auditors as vital to his success in perpetrating schemes. “Put up against an auditor with absolutely no experience, and I’ll have them for lunch,” he said.

The U.S. Securities and Exchange Commission refers to auditors as “gatekeepers,” tasked with safeguarding financial statements and assuring that records are free of material misstatements, whether by error or fraud. As financial gatekeepers, they’re supposed to cast a critical eye on financial documents to assess whether there are indications of fraud risk and consider how fraud could be perpetrated and concealed by anyone in the organization.

Yet, despite these professional expectations, auditors don’t always meet them in practice. According to the ACFE’s Occupational Fraud 2026: A Report to the Nations, 43% of the fraud cases studied in the report were detected by tips, generally from employees, customers and vendors. Internal auditors detected fraud in 15% of cases in the report, and external auditors only detected 2% of frauds. Some of the biggest fraud scandals in recent history were anchored by auditors who overlooked fraudulent activity. Most notably, the collapse of Enron involved accounting firm Arthur Andersen’s failure to detect fraud in the Houston, Texas-based energy company’s financial statements. In 2018, external auditors for Indian tech firm Satyam were barred from auditing publicly listed companies in India for two years for complicity in fraud and failure to adhere to auditing standards. In the 2020s, several large auditing firms faced legal trouble for not identifying and responding to suspected fraud that slipped through their gates and into their clients’ financial transactions. Failing to exercise professional skepticism exposes auditors to legal risk. In the U.S., the Public Company Accounting Oversight Board (PCAOB) may penalize auditors for not employing professional skepticism during engagements. In a 2024 case, the PCAOB sanctioned auditors who failed to obtain sufficient evidence to support their opinions and evaluate whether the client’s revenue was properly valued and presented in financial statements. The board imposed limitations on the auditors’ future engagements and fined them $130,000.

A 2025 study published in the Accounting, Auditing and Accountability Journal sought to understand why auditors may fail to identify fraud. From interviews with 23 fraud offenders in Australia, the authors of the study, “Ritualistic exploitation: Fraud offender perspectives on auditing and auditors,” posit that auditing failures persist because fraudsters are sophisticated actors who can exploit vulnerabilities in auditors’ work routines. According to the authors, fraud offenders frequently deploy impression management tactics as they interact with auditors. Fraud offenders interviewed in the study described their interactions with auditors as they perpetrated their fraud schemes. The authors then identified offenders’ perspectives on auditing practices and the strategies they used to conceal their crimes through knowledge of auditing routines and practices. While the study is small and limited to one region, the thoughts from the offenders should raise concerns about how they perceive essential anti-fraud-related practices and procedures. Here we examine the findings of this study, how fraud offenders think about their exploitation tactics, and call on auditors to fortify their professional skepticism skills, especially as they engage with clients, co-workers and managers during audit engagements.

The rituals of auditors

Rituals are structured, formalized routines. Within organizations, rituals are often standardized, predictable, repetitive behaviors that align with performance expectations. Auditors have their own rituals of repeated routines to ensure that financial data is reliable; those rituals include planning audits, preparing working papers and opinion letters, determining the length of an engagement and how substantive procedure testing should be, and of course, identifying fraud risk. The authors of the 2025 study suggest that interactions with clients during audits could have some influence on auditors’ findings.

Although auditors are often considered fraud watchdogs, offenders in the 2025 study expressed feeling invulnerable to fraud detection. As one offender told researchers, the auditor “was the last thing I was worried about.” In this instance, the fraud offender didn’t perceive the auditor as a threat or a barrier to perpetrating a scheme. The auditor’s program, procedures and good faith were no match for the offender’s exploits.

Stable and predictable audit programs

Fraud offenders interviewed for the study saw audit programs as stable and predictable; the predictable timing of audits was an opportunity for fraudulent behavior. According to one offender, knowing when an audit was scheduled gave them a chance to manipulate records. “We typically actually never heard from [auditors] until the end of the financial year to get your house in order. That’s a long time. So, when the audit was coming, I thought, well, I need something to try and cover this up.” 

The scope of an audit

Although many audits include procedures for fraud risk management and detection, traditional financial statement audits of public and private companies aren’t designed for that purpose. Instead, they’re designed to find unintentional material errors in financial reports by examining a limited sample of transactions. Many of the offenders interviewed for the study perceived that fraud detection wasn’t actually important during audits, and if questions were raised about fraud, one offender remarked, “The short answer was, ‘It is outside the scope of the audit.’” 

Acting in good faith

According to offenders’ accounts, the auditors they interacted with were generally satisfied by taking clients’ representations at face value and assuming they were acting in good faith, which facilitated fraud concealment opportunities. “Where there is a relationship, it is just too easy,” said one offender. “No one likes to think that the person that they know that they are sitting with would commit fraud.” 

Samuel Antar, who helped commit one of the biggest financial statement fraud schemes in the 1970s and 1980s as chief financial officer of electronics store Crazy Eddie, echoed that sentiment on his website, White Collar Fraud, explaining that he could erode auditors’ professional skepticism because the auditors “didn’t want to believe we were crooks. They believed whatever we told them without verifying the truth.” 

Audit engagement pressures

Fraudsters in the study reported thinking that auditors prioritize time and cost pressures over the diligent exploration of fraud risks. “A lot of the time they are so busy. If you say, ‘I’ll get back to you,’ they never get back to you anyway,” according to one offender. A 2013 study published in Contemporary Accounting Research supports this perception. A fraud offender in that study remarked, “Initially, I wasn’t surprised that we got away with it … But by the end, I couldn’t see how they couldn’t detect anything. I spoke to the CFO, and he said that if they, the auditors, did detect anything, he would say that we would get back to them. And he couldn’t believe how they would accept even the flimsiest of a possible excuse. A note was sufficient.” 

Experience and competence

Offenders expressed to the study authors that when auditors were inexperienced or lacked competence, offenders felt empowered to conceal their fraud schemes. Some offenders commented that the auditors they’d interacted with were “just young kids,” without the developed professional experience to be skeptical of individuals who could easily dismiss their work and could “get rid of them” by “handing them a bit of paper” as they seemed to have “no idea” what they were dealing with. In a 2013 study published in the Journal of Investigative and Forensic Accounting, the authors quoted Antar on his view of working with inexperienced auditors. “Most large accounting firms use relatively inexperienced kids right out of college to do basic audit leg work. They are supervised by slightly more experienced senior auditors, who unfortunately, depend on feedback from these inexperienced kids in making informed decision.”

Impression management tactics

Fraud offenders are often highly skilled in the art of impression management, also known as self-presentation. Impression management is how people present themselves to others and control how others perceive them in ordinary, day-to-day interactions, especially in professional environments. How do fraud offenders rely on impression management tactics to deceive auditors and deflect scrutiny from their fraudulent actions? The authors of the study identified five key impression management techniques offenders may use in their interactions with auditors, including:

1. Ingratiation.
2. Exploiting time.
3. Bamboozling (tricking or deceiving someone by confusing them).
4. Supplication (emphasizing personal weaknesses to elicit sympathy).
5. Instrumental aggression (calculated physical or social aggression used as a means to an end). 

Auditors should become familiar with these impression tactics to enhance their skepticism when interacting with clients, co-workers and management, especially in cases where an individual may provide an excuse to avoid participating in an in-depth investigation or attempt to deflect an auditor’s question during an audit. The following sections detail these key impression management methods

Ingratiation

In the 2025 study, the authors identified ingratiation as an impression management tactic frequently employed by fraud offenders when interacting with auditors. Offenders strived to come across as likeable to build rapport with auditors through friendly and professional interaction. Recognizing auditor engagement pressures, offenders spoke of presenting everything they required in a professional manner. “I presented everything that he needed and it was done perfectly,” said one offender in the study. “Now, behind the scenes, I might have had to have done that eight times to get it, to move things around to get it right … So, it was priceless I would have always been warm and friendly, professional, and a little bit over-helpful … We’d have dinner afterwards, a great old time.” 

Antar was adept at manipulating accountants to “make them into enablers,” by dialing up the charm through aggressive likability and being familiar with them. “The more I’m with you, the more I can get you to like me as a criminal — without even knowing I’m a criminal. I’ll know your tastes, your politics, what you like, what you dislike,” Antar recounted in a 2012 Trusted Professional article. White-collar criminals often measure their effectiveness by how likeable others find them; the more their victims like them, the easier it is to defraud them. They rely on “deceit and misdirection, two things that require a congenial environment to operate effectively,” said Antar. “I say, watch the guys who’re nicer to you because, as a criminal, I was nicer to my victims than my friends. Just because someone appears to be likable doesn’t mean they’re good people. You have to steal with a smile.” He’d later write on his website in 2023 that fraudsters “fabricate false integrity to gain the trust of their victims. Stature, generosity, and virtuous deeds gain the respect of their potential victims and make it less likely that victims will question their behavior.”

Exploiting time

Well-planned audits are designed for efficiency, but this efficiency often lends offenders ample time to plan their deceptions. As one offender in the 2025 study stated, “You get the auditor to come out to see you every three months. They send an email to you and say, ‘Can you send me these files by email within two days?’ Even in two days, I have time to manipulate the information that they want to see.”

Bamboozling

Fraud offenders are skilled in confusion and trickery and may rely on their extensive experience and knowledge of accounting systems to conceal fraud, in an impression management tactic known as bamboozling. They can sense when auditors are inexperienced or lack knowledge and create credible explanations about their manipulations, knowing the auditor wouldn’t question them. “The auditor that they sent in did not understand the whole business,” one offender told researchers of the 2025 study. “The whole thing was quite complicated … It was over his head, and he couldn’t really grasp it. By the time I tried to explain it by the journal entry, he said, ‘OK.’ But he didn’t quite grasp it.” In the same study, another offender remarked, “Much of the time, the auditor just wants a reason to move on to the next item. What you tell them just has to be believable — not necessarily believed. If they can document that they raised the issue and got a plausible response, an explanation that fits, that is sufficient.”

Supplication

Supplication is an impression management tactic in which an offender “plays dumb,” to get support and persuade their target. “I found it important when it came to the auditors that I was never fully qualified, so I always had a fallback,” said one offender in the study. “‘Oh OK, I didn’t realize that.’ There’s always that way out.” Here, the offender wanted to give the impression that they weren’t fully qualified as an accountant, so when they were worried that their scheme would be detected, they’d feign not understanding the technical aspects of the job.

Instrumental aggression

Hostility, harassment, intimidation, threats, belittlement and humiliation are methods of instrumental aggression. Fraudsters may employ this impression tactic to deflect auditors’ uncomfortable questions about their activities. As one offender told researchers, “If they really start getting questions you just get angry at them and say ‘Mate, I’ve told you four times. Can’t you get it? Grab your boss and I’ll speak to him about it.’ If you just be aggressive at them most of them would go away anyway.”

Understanding how fraud offenders think

Fraud offenders display criminal thinking traits to opportunistically exploit people just like other types of offenders. Antar’s writings about his past life as a fraudster demonstrate what it looks like to rely on criminal thinking: “Everybody has an exploitable weakness. The fraudster’s job is to find the people who have an exploitable weakness that he/she can take advantage of,” he explained. Fraud offenders “use a combination of persuasion and deceit to achieve their objectives, and they prey on the psychological and cognitive vulnerabilities of their victims.”

As Antar described it, fraudsters view others’ good intentions, ethics, morals and decency as weaknesses to exploit. “The inclination to trust and the presumption of innocence gives the fraudster the initial benefit of any doubt while they are free to plan and execute their crimes.” For most people, trust in others, ethics and morals are behavioral stopgaps, but fraudsters see these limitations as opportunities to plan and carry out their schemes. “Fraudsters are unfettered by society’s moral constraints on behavior,” said Antar.

A fraud offender may look at someone’s trust in others as assurance that their claims will never be verified and will decrease any professional skepticism they might have to follow up on an issue. In other words, an auditor might be willing to accept deceptive answers as factual, even if they have some nagging doubts. It’s common for victims of fraud to rely on “unexamined acceptance.” But claims from any source shouldn’t be taken for granted as truthful or accurate without critical analysis, investigation and verification. “Learn to exercise professional paranoia. Do not trust. Just verify,” advised Antar.

Professional skepticism mitigates audit failures

Not employing professional skepticism is a reason why many audits don’t detect fraud. Predictable audit routines facilitate workflows, but they can also diminish professional skepticism as standardized tasks become step-by-step checklists that prioritize efficiency over time spent inquiring deeply into suspicious behavior or following up on something that doesn’t seem right. However, being able to identify impression management tactics during an audit encourages auditors to exercise professional skepticism to perform additional analytic procedures and detailed testing to corroborate any assertions.

When planning audits, teams should include discussions about responses to interactions that raise red flags of someone trying to manipulate or exploit situations through impression management, such as being overly friendly or overly aggressive, wasting time or seeming oblivious to information they should know. In these situations, auditors should pause and take time to discuss their observations with their team to gauge their skepticism and consider whether the engagement needs to be modified and expanded for substantive procedures to verify financial representations. 

While professional skepticism is an indispensable skill for auditors, it can’t flourish in an environment that doesn’t encourage it. It’s imperative that management create a supportive environment for auditors to follow up on their suspicions. Employing additional tests and scrutiny takes time, and organizations must foster careful, methodical audits rather than rapid timelines. Strengthening auditors’ awareness of these tactics to expand auditing procedures through training may enhance professional skepticism, improving auditors’ ability to identify and investigate potential fraud. Having audit teams practice impression management tactics through interactive role-playing could be part of this training. Individuals may take turns playing fraud offenders and auditors to practice reactions and responses to various impression management techniques.

Auditors can also better manage fraudsters’ behavioral techniques with surprise audits. Injecting unpredictability into the process by selecting different times and locations for audits and choosing not to announce when an audit occurs can stymy fraudsters’ attempts to manipulate documents and carefully conceal their crimes.

Lastly, upgrading technology with artificial intelligence may help auditors better balance efficiency with professional skepticism. Auditors can automate routine tasks to free up time for deep data analysis for anomalies that might otherwise go undetected when relying on human judgment alone. AI tools can analyze large datasets instead of small, sample tests of data and identify anomalies that auditors can apply their professional skepticism to.

An indispensable mindset

Auditors face criticism — and legal liabilities — when fraud is exposed after they’ve given an organization a clean bill of health for its financial statements. However, understanding how fraud offenders may try to impede audits through impression management techniques sharpens a fundamental auditing skill of skepticism. Auditors must avoid relying on the trust they’ve placed in colleagues and clients, and on routinized workflows to enhance scrutiny of financial transactions. As Barry Webne demonstrated through his interactions with auditors, fraudsters don’t merely exploit control system weaknesses; they manipulate auditors’ basic job duties and trust via deception and impression management to conceal fraud. Understanding these tactics may help diminish fraudsters’ ability to successfully manipulate and exploit auditors.

Frank S. Perri, JD, CFE, CPA, is an attorney in Illinois. Contact him at frankperri@hotmail.com.