Traditional audit training has produced auditors with a conformance mindset who focus on compliance with policies and procedures and are typically perceived as the organization's 'internal policemen'. This may hinder effectiveness in auditing 'conduct risk' - i.e., behaviors that would cause problems to consumer protection, market integrity or competition. Drawn from an action research inquiry designed to reconfigure the Internal Auditing Function of a branch of a financial institution, this paper shows how cultivating a 'reflexive mindset' becomes a critical catalyst in developing a different internal auditing approach that leads to the identification of misconduct and potential conduct risk.