Daniel Kahneman’s Thinking, Fast and Slow is the summary, by one of its two founders, of forty years of research into how human judgment actually works and how it departs from the way we believe it works. Published in 2011, nine years after Kahneman received the Nobel memorial prize in economics for work done with the late Amos Tversky, it introduced a general readership to the two systems of thinking, to the heuristics and biases that shape estimates of probability and value, to prospect theory’s account of risk and loss, and to the planning fallacy and the outside view. For an internal auditor the book is a description of the raw material of the job: every risk assessment, every rating of a finding, every acceptance of a management estimate and every review of a workpaper is a judgment made by a mind that works the way the book says, and the book provides both the catalogue of errors and a handful of remedies. This guide summarises the book without reproducing it, sets out the main ideas, maps them to audit practice, notes where the research has aged, and ends with a worked example of an audit function running a pre-mortem on its own plan.
In this guide
- The book in one page
- Who Daniel Kahneman was, and where the book came from
- The structure: five parts
- The two systems, and why they matter to judgment
- The biases an auditor meets most
- Prospect theory: how people decide under risk
- The remedies the book offers
- The nine ideas worth keeping
- The vocabulary: fourteen terms defined for practitioners
- What it means for internal audit: judgment under the microscope
- Expert intuition: when to trust it, and when an auditor should not
- The criticisms, and where the research has aged
- Editions, reading time and how to read it
- A one-hour discussion guide for an audit team
- Worked example: Ashgrove Health System runs a pre-mortem on its audit plan
- Frequently asked questions
- Related guides
The book in one page
| Question | The answer, in our words |
|---|---|
| What is the central idea? | That the mind runs two modes: a fast, automatic, intuitive one (System 1) that generates impressions and answers without effort, and a slow, deliberate, effortful one (System 2) that can check and override them but is lazy and often does not. Most judgments are System 1 products that System 2 endorses. |
| What goes wrong? | System 1 substitutes easy questions for hard ones, judges by what comes readily to mind, anchors on whatever number it has seen, ignores base rates and sample sizes, builds coherent stories from thin evidence, and is confident in proportion to the coherence rather than the evidence. |
| How do people decide under risk? | Not by expected value. Prospect theory shows that outcomes are judged as gains or losses from a reference point, that losses hurt about twice as much as equivalent gains please, and that small probabilities are overweighted and large ones underweighted. |
| Can it be fixed? | Only partly, and mostly by procedure rather than willpower: base rates and reference classes, decomposition, pre-mortems, independent estimates before discussion, and checklists that force System 2 to engage. |
| What has not held up? | The chapter on priming relies on studies that have failed to replicate, as Kahneman acknowledged, and the ego-depletion research in chapter three has failed a large multi-lab replication; the core findings on heuristics, biases and prospect theory have held. |
| Why read it as an auditor? | Because the profession’s product is judgment, and the book is the standard account of how judgment fails; because its remedies are procedures an audit function can adopt in a quarter; and because it explains the behaviour of the managers whose estimates the function reviews. |
| Reading time | About seventeen hours for the 500-page paperback; the first three parts carry most of what an auditor needs. |
Who Daniel Kahneman was, and where the book came from
Kahneman, who died in 2024, was an Israeli-American psychologist whose collaboration with Amos Tversky from the late 1960s produced the research programme on heuristics and biases and, in 1979, prospect theory, the account of decision under risk for which Kahneman received the Nobel memorial prize in 2002, Tversky having died in 1996. He spent his later career at Princeton and continued to publish on wellbeing, on expert judgment and, in his last book Noise (2021, with Olivier Sibony and Cass Sunstein), on the variability of judgment. Thinking, Fast and Slow, published by Farrar, Straus and Giroux in October 2011, was his attempt to put the programme into one book for a general reader, with the research presented through the experiments that produced it and, unusually, with Kahneman’s own errors and changes of mind included. It was a bestseller for years and is widely cited in professional literature, including auditing’s.
The structure: five parts
| Part | What it covers | What it contributes for an auditor |
|---|---|---|
| Part one: two systems | System 1 and System 2; attention and effort; cognitive ease; associative memory; the mechanisms of jumping to conclusions | The model of the mind that the rest rests on |
| Part two: heuristics and biases | The law of small numbers, anchoring, availability, representativeness, causes versus statistics, regression to the mean, taming intuitive predictions | The catalogue of errors in estimation |
| Part three: overconfidence | The illusion of understanding, the illusion of validity, expert intuition and when to trust it, the outside view and the planning fallacy, optimism and the entrepreneurial delusion | The part most directly about forecasts and plans |
| Part four: choices | Prospect theory, the endowment effect, framing, rare events, risk policies, mental accounting, regret | How decisions under risk are made, including by management |
| Part five: two selves | The experiencing self and the remembering self; the peak-end rule; wellbeing | Less directly applicable; interesting on how outcomes are remembered |
The two systems, and why they matter to judgment
The names are a convenience, not an anatomy, and Kahneman says so. System 1 is the mind’s default: it recognises faces, completes phrases, detects hostility in a voice, and produces an immediate sense of what is going on and what to do, with no feeling of effort. System 2 is what we think of as thinking: it computes, compares, checks and chooses, and it is slow, serial and tiring, and because it is tiring it is lazy. The consequence for professional judgment is that most conclusions are formed by System 1 and ratified by System 2, which feels like reasoning but is often the endorsement of an impression. An auditor reviewing a reconciliation forms a view of whether it looks right before examining it; the examination then tends to confirm the view. The book’s remedies are all, at bottom, ways of making System 2 do the work before System 1 has decided, or of structuring the environment so that the impression is formed from the right inputs.
The biases an auditor meets most
| Bias | What it is | Where it appears in audit work | A countermeasure |
|---|---|---|---|
| Anchoring | Estimates are pulled toward any number encountered first, even an irrelevant one | The prior-year risk score; management’s opening figure for an estimate; the first rating proposed in a meeting | Estimate independently before seeing the anchor; start the risk assessment from a blank, not from last year |
| Availability | Likelihood is judged by how easily examples come to mind | Risk assessments that spike after a publicised incident and fade after a quiet year | Base rates from the incident log and from outside the organisation |
| Representativeness | Judging by resemblance to a stereotype, ignoring base rates and sample size | A process that looks well run is rated low risk; a sample of five exceptions is read as a pattern | Ask what the base rate is; compute the sample size needed before interpreting |
| The law of small numbers | Treating small samples as representative | Conclusions from a handful of items; see the sampling guide | Size the sample before testing, not after |
| WYSIATI (what you see is all there is) | Building a coherent story from the evidence available and ignoring what is missing | A clean walkthrough taken as a clean process; the silent evidence problem in the Black Swan summary | List what evidence would exist if the conclusion were wrong, and look for it |
| Confirmation | Seeking and weighting evidence that supports an existing belief | Reviewing to approve; testing the hypothesis the auditor already holds | Assign someone to argue the opposite; the professional skepticism guide |
| Hindsight | Believing after the fact that the outcome was predictable | Post-mortems that find the warning obvious; blame of the last person | Record predictions before outcomes; the root cause guide |
| Overconfidence and the illusion of validity | Confidence driven by the coherence of a story, not the quality of evidence | Ratings and opinions stated without uncertainty; management forecasts accepted | Calibration training; ranges instead of points; the Superforecasting summary |
| The planning fallacy | Underestimating time, cost and risk of plans by focusing on the specific case | Audit plan hours; remediation dates; project reviews | The outside view: reference-class data on how similar plans turned out |
| Loss aversion and framing | Losses weigh more than gains; choices change with how options are described | Management’s reluctance to write off; findings accepted or rejected depending on framing | Frame findings consistently; present the loss of inaction alongside the cost of action |
| Sunk cost | Continuing because of what has been spent | Projects that will not be stopped; audits that will not be rescoped | Decide as if starting now |
Prospect theory: how people decide under risk
Part four is the account of decision-making that earned the prize. Standard economics assumed people value outcomes by their final wealth and weight them by their probability. Kahneman and Tversky showed, through simple hypothetical choices put to groups of students and university faculty, that outcomes are evaluated as gains or losses relative to a reference point, usually the status quo; that the pain of a loss is roughly twice the pleasure of an equivalent gain; that people are risk-averse for gains and risk-seeking for losses, which is why a manager facing a certain small loss will gamble on a larger one; and that probabilities are weighted non-linearly, with rare events overweighted and near-certainties underweighted. Three audit implications follow. Management will resist recognising a loss long after the evidence supports it, and will take risks to avoid it, which is the mechanism behind the “hole” in the Why They Do It summary. The framing of a finding changes its reception: a control gap presented as a loss of assurance lands differently from the same gap presented as an opportunity. And risk appetite statements built on expected value will be ignored in practice by people who do not decide that way; the ERM guide treats this as a design consideration.
A note on the two most audit-relevant findings in parts two and three. Regression to the mean is the one professionals most often misread: a unit that performed worst last year will, on average, perform better this year for purely statistical reasons, and the improvement will be attributed to whatever intervention happened in between, including the audit. A function that wants credit for improvements should expect this bias in its favour and should discount for it. The illusion of understanding is the other: the mind constructs a coherent narrative from whatever facts it has, and the sense of understanding that follows is unrelated to the completeness of the facts. The walkthrough that produces a clear picture of a process has produced a picture, and the book’s discipline is to ask what has been left out before being satisfied with it.
The remedies the book offers
- The outside view. Before estimating a specific case, find the reference class and its base rate: how long do projects of this kind take, how often do remediation plans finish on time, what share of this type of control fails. Then adjust. The book’s own example is Kahneman’s textbook project, which his team estimated at two years and which took eight, as the reference class predicted.
- The pre-mortem. Gary Klein’s technique, endorsed by Kahneman: before a plan is adopted, the team imagines it is a year later and the plan has failed, and each member writes the history of the failure. It legitimises doubt and surfaces risks that confidence had suppressed.
- Independent judgments before discussion. Groups anchor on the first view expressed; collecting estimates privately first preserves the information in disagreement.
- Decomposition and checklists. Breaking a judgment into components, each assessed separately, reduces the influence of overall impressions; a checklist forces System 2 to engage with each.
- Regression to the mean, remembered. Extreme results are followed by less extreme ones for statistical reasons; a control that performed badly last year will likely perform better this year whatever is done, and the improvement should not be credited to the action.
- Calibration and feedback. Expert intuition is trustworthy in environments with regular feedback and enough practice; where feedback is absent or delayed, as in most audit judgments, intuition should be checked against data.
The nine ideas worth keeping
- Judgment is mostly intuition endorsed by reasoning. The feeling of having thought something through is not evidence that one has.
- Confidence tracks coherence, not evidence. A clear story built from little produces more certainty than a muddled story built from a lot.
- Base rates are the most neglected input in professional judgment. The outside view is the single most useful remedy in the book.
- Anchors are everywhere and cannot be ignored by trying. The only defence is to form the estimate before meeting the anchor.
- Small samples lie. The law of small numbers is the reason sampling guidance exists.
- Losses loom larger than gains. Management’s reluctance to recognise a loss is a predictable feature of human decision-making, not a character flaw, and controls over estimates should assume it.
- Hindsight rewrites the record. Predictions must be written down before outcomes to be assessed.
- Expert intuition is valid where feedback is fast and regular. Audit judgments mostly lack that feedback, which is why keeping score matters.
- Procedures beat resolutions. People cannot debias themselves by wanting to; organisations can reduce bias by changing how judgments are made.
The vocabulary: fourteen terms defined for practitioners
| Term | What Kahneman means | What it looks like in an audit |
|---|---|---|
| System 1 / System 2 | Fast automatic thinking / slow deliberate thinking | The first impression of a workpaper / the review that checks it |
| Heuristic | A mental shortcut that substitutes an easy question for a hard one | Rating a process by how it looks |
| Anchoring | Estimates drawn toward an initial number | Last year’s score; management’s first figure |
| Availability | Judging frequency by ease of recall | Risk spikes after incidents |
| Representativeness | Judging probability by resemblance | Stereotyped risk ratings |
| Base rate | The underlying frequency in the reference class | How often this type of control fails |
| WYSIATI | What you see is all there is: ignoring absent evidence | The clean walkthrough |
| Regression to the mean | Extreme observations tend to be followed by less extreme ones | Last year’s worst process improving on its own |
| Illusion of validity | Confidence in a judgment from the coherence of the evidence | An opinion stated without uncertainty |
| Outside view | Starting from the reference class | Base rates for plans and remediation |
| Planning fallacy | Underestimating time, cost and risk | Audit hours and project reviews |
| Prospect theory | Decisions judged as gains and losses from a reference point | Management’s loss aversion |
| Framing | Choices changing with the description of options | How findings are presented |
| Pre-mortem | Imagining failure before committing | A planning procedure for audits and projects |
What it means for internal audit: judgment under the microscope
The book applies to the function’s own judgments and to the management judgments it reviews. The table sets out both. The professional judgment guide, the professional skepticism guide and the risk assessment guide carry the detail.
| Audit activity | The bias at work | The procedure the book implies | Proportionate practice |
|---|---|---|---|
| Annual risk assessment | Anchoring on last year; availability after incidents | Blank-sheet estimates before the prior scores are shown; base rates from outside the organisation | Score the top thirty units blind, then compare with last year; explain every unchanged score |
| Rating findings | Illusion of validity; framing | A probability and a range, stated; consistent framing in the template | The Hubbard summary‘s one-line addition |
| Reviewing management estimates | Anchoring on management’s figure; loss aversion in management | Form an independent estimate first; ask for the reference class | The reviewer records an estimate before opening management’s paper |
| Planning audit hours and remediation dates | The planning fallacy | Reference-class data on past engagements and past remediations | The issue tracking guide‘s base rates; a pre-mortem on the plan |
| Interpreting test results | The law of small numbers; representativeness | Sample sizes set before testing; base rates for exception rates | The sampling guide |
| Workpaper review | Confirmation; the lazy System 2 | A review question list that forces engagement; an assigned dissenter | The review notes guide‘s challenge step |
| Post-incident review | Hindsight | Reconstruct what was known at the time; record predictions going forward | The root cause guide |
| Opining on management’s risk process | WYSIATI about the process itself | Ask what the process does not see; test completeness against outside evidence | The ERM guide‘s completeness tests |
Expert intuition: when to trust it, and when an auditor should not
One chapter deserves separate attention because it answers a question every experienced auditor asks about themselves. Kahneman had spent a career cataloguing the failures of intuition; Gary Klein had spent his documenting its successes among firefighters, nurses and chess masters. They wrote a joint paper and reached an agreement that the book reports. Intuition is trustworthy when two conditions hold: the environment is regular enough to contain cues that can be learned, and the practitioner has had enough practice with prompt, unambiguous feedback to learn them. The firefighter who senses a floor is about to give way has met both conditions. The stock picker, the political pundit and, in most of their work, the auditor have not. An auditor’s feedback is slow and partial: a control opinion is rarely tested against an outcome the auditor sees, a risk rating is seldom compared with what happened, and the cases that would correct an intuition arrive years later or not at all.
The implication is not that experienced auditors should distrust their instincts in every case; it is that they should know which of their instincts have been trained. The sense that a reconciliation is wrong, formed over hundreds of reconciliations whose errors were found and shown, is probably reliable. The sense that a management team is trustworthy, formed over a career in which the untrustworthy ones were rarely exposed to the auditor who trusted them, is probably not, and the professional skepticism guide exists because of the difference. The practical response is to build the feedback that the environment does not supply: to record judgments, compare them with outcomes and tell the team what the comparison showed, which turns an unlearnable environment into a partly learnable one. The Superforecasting summary describes a function that did exactly this and what it learned about its own ratings in a year.
The criticisms, and where the research has aged
The book has aged in two specific places and held in most others. The chapter on priming, which presents experiments in which exposure to words or images altered subsequent behaviour, relies on studies that the replication movement of the 2010s failed to reproduce; in 2017 Kahneman wrote that he had placed too much faith in underpowered studies and that the evidence for the chapter’s ideas was much weaker than he had believed when he wrote it. The ego-depletion studies described in chapter three have not held up either: a preregistered replication across 23 laboratories, published in 2016, found an effect indistinguishable from zero. The heuristics-and-biases programme more broadly has been criticised, notably by Gerd Gigerenzer, for treating as errors what may be adaptive responses to uncertain environments, and for experiments whose framing invites the bias they report; the debate is live and the book presents one side of it. Prospect theory and the core heuristics, anchoring, availability, representativeness and the planning fallacy, have replicated well and are in standard use. For an auditor the practical reading is unaffected: the remedies the book recommends, base rates, independent estimates, pre-mortems and calibration, are procedures that improve judgment whatever the theoretical dispute, and the Superforecasting summary reports the evidence that they do.
Editions, reading time and how to read it
| What | Details | Best for |
|---|---|---|
| Hardback | Farrar, Straus and Giroux, October 2011, about 500 pages | The first edition |
| Paperback | FSG, 2013 | The edition most readers own |
| Audiobook | Unabridged, about twenty hours | Long; the experiments are easier to follow on the page |
| Reading plan | Parts one to three in full; part four for prospect theory; part five optional | An auditor with three evenings |
| Companion reading | Noise (2021) for the variability of judgment; the Superforecasting summary for calibration in practice; the Black Swan summary for the limits | Placing the argument |
| The appendices | The two original papers with Tversky, on judgment under uncertainty and on choices and framing | The primary sources, short and readable |
A one-hour discussion guide for an audit team
- Ten minutes: the anchor test. Give half the team a high number and half a low one, unrelated to the question, then ask everyone to estimate the organisation’s annual control-failure rate. Compare the halves.
- Fifteen minutes: the outside view. Take the function’s current plan and find a reference class for its three largest engagements: how long did engagements of this type take in the last three years? Compare with the budgeted hours.
- Fifteen minutes: the pre-mortem. Imagine the plan year is over and the function has missed something that mattered. Each person writes the story in five minutes; read them aloud.
- Ten minutes: loss aversion. Discuss the last estimate or write-off that management resisted, and whether the resistance fits the book’s account.
- Ten minutes: the procedure. Choose one remedy, blind scoring, independent estimates, or the pre-mortem, and adopt it for the next planning cycle.
Worked example: Ashgrove Health System runs a pre-mortem on its audit plan
Ashgrove Health System is a fictional non-profit of five hospitals with $2.1 billion in revenue and an internal audit function of twelve. For the 2027 plan the director added two of the book’s procedures: blind scoring of the risk assessment before the prior-year scores were revealed, and a pre-mortem on the draft plan in which each auditor wrote, in ten minutes, the story of how the plan had failed by the end of the year.
| Procedure | What it produced | What changed |
|---|---|---|
| Blind scoring of the top thirty units | Eleven units scored differently from the prior year by two points or more; in nine of the eleven the prior-year score had been carried forward unchanged for at least three years | The eleven were re-discussed with the business; four changed rank enough to move in or out of the plan |
| Pre-mortem story: “we audited the revenue cycle again and missed the pharmacy automation go-live” | Six of twelve auditors wrote some version of this; the go-live was in the plan as a post-implementation review eighteen months out | A pre-implementation review added in the second quarter; the change management audit guide used |
| Pre-mortem story: “the remediation dates we accepted all slipped” | Four auditors; the base rate from the tracker showed 46 percent on time | Dates now negotiated with the base rate on the table; the Superforecasting summary‘s scoring adopted |
| Pre-mortem story: “the one high finding was framed as a compliance gap and nobody acted” | Two auditors | Finding template revised to state the loss of inaction in the first sentence |
| Outside view on engagement hours | The three largest engagements were budgeted at 70 percent of the hours comparable engagements had taken in the prior three years | Budgets revised; one engagement deferred |
| Independent estimates before the planning meeting | Collected by email beforehand; the meeting began with the spread rather than with the director’s view | The director’s own ranking changed on two units |
The exercise cost the function about three days across the team and changed six elements of the plan, one of which, the pharmacy pre-implementation review, found a segregation-of-duties problem in the vendor’s configuration that would have gone live. The audit committee’s minute recorded that the plan had been built, for the first time, with the function’s own biases treated as a risk. That is the book applied: not a change in what the auditors believed about themselves, which the book says is unattainable, but a change in the procedure by which their judgments were made.
Frequently asked questions
Is the book still reliable after the replication crisis?
Mostly. The priming chapter is not, as Kahneman said himself, and neither are the ego-depletion studies in chapter three; the heuristics, the planning fallacy, prospect theory and the remedies have held up, and the remedies are what an auditor uses.
What is the single most useful idea for an auditor?
The outside view: start every estimate from the base rate of the reference class and adjust from there. It corrects the planning fallacy, anchoring and representativeness at once, and it costs nothing but the lookup.
How does it relate to professional scepticism?
Scepticism is the disposition; the book explains why the disposition is hard to maintain and provides the procedures that do its work when the disposition fails. The professional skepticism guide covers the audit side.
What does prospect theory mean for reviewing management estimates?
That management will resist recognising losses longer than the evidence warrants and will take risks to avoid a certain loss, as a predictable feature of decision-making. Controls over estimates should assume that tendency rather than rely on management’s objectivity.
Should a whole audit team read it?
The first three parts, yes; they are the common vocabulary for discussing judgment. The pre-mortem and blind-scoring procedures can be adopted by a team that has read only the discussion guide above.
Where does the book sit in the reading list?
At the head of the decision-making group in the internal audit reading list, followed by Superforecasting for the method and Hubbard for the risk application.
Related guides
- Professional Judgment in Audit — how judgments are formed and documented
- Professional Skepticism: The Auditor’s Stance — the disposition the book explains
- Internal Audit Risk Assessment: Method, Scoring and Template — where blind scoring and base rates live
- Superforecasting: Summary and Lessons for Auditors — calibration and keeping score
- The Failure of Risk Management: Summary for Auditors — the remedies applied to risk assessment
- The Black Swan: Summary and What It Means for Auditors — the limits of judgment about rare events
- The Best Books for Internal Auditors — where this book sits among the others
- All book summaries — the full set of summaries for auditors
- Noise by Kahneman, Sibony and Sunstein: Summary and Lessons for Auditors — why judgments that should agree do not
- Thinking in Bets by Annie Duke: Summary and Lessons for Auditors — judging decisions apart from their outcomes.
Leave a Reply