Part IV · Chapter 7 · The Audit · lesson 4
The three questions that produce most findings
12 min
Builds on What would you hand them, right now, for this one?
Part IV · Chapter 7 · The Audit · lesson 4
12 min
Builds on What would you hand them, right now, for this one?
Three questions. Between them they are upstream of almost everything that ends up written in a report.
Who approved this.
Show me the one from March.
What happened the time it failed.
They are not clever and they are not secret. They keep working because each one aims at a different thing a control needs in order to be a control rather than a habit, and most controls are missing one of the three.
Predict
Each question aims at one of the three things a control has to have.
Who approved this aims at authority. Somebody with standing looked, and could have said no. A control performed by the person it constrains is not a control; it is a routine with paperwork.
Show me the one from March aims at history. The control did not just run, it ran repeatedly, in the middle of the period, when nobody was preparing for anything.
What happened the time it failed aims at detection. If the control stops, or finds something, somebody learns. A control nobody would notice failing is a document.
Authority, history, detection. Three questions, one each, and findings cluster under them almost without exception.
The answer that lands is a name and a date, where the name belongs to somebody who was not the person doing the work.
What this finds, over and over: the approval that is a group mailbox rather than a person. The approval dated after the thing it approved. The approver whose only qualification is that they had the button. The exclusion in a register with no name attached to the decision to exclude. The risk marked accepted with nobody recorded as having accepted it — which is, by a distance, the most common real finding in this entire field.
Self-approval is worth separating from the rest, because at six people it is sometimes genuinely unavoidable. The difference between a defensible position and a gap is whether somebody decided it and wrote down what stands in for the second pair of eyes. Nobody else was available is a fact. Nobody noticed the policy said two and the settings allowed one is a finding.
Not the first one. Not the most recent one. One from the middle.
Evidence clusters at the ends of a period for reasons that have nothing to do with honesty. The first instance is careful because the control was new and somebody was paying attention. The last one is careful because the period is ending and somebody is getting ready. The sixteen weeks in the middle are the control's actual behaviour when nobody is watching, and that is what the question reaches for.
It also quietly tests three other things at once. Retention — whether the system still holds something from eight months ago, which is a different question from whether the control ran. Your population list — if you said twelve and March is missing, there were never twelve. And production on demand — an artefact created the day it was requested has a timestamp saying so, and it answers a different question from the one asked.
This is the question that separates a control from a calendar invite.
The useful version is specific: the time the review found an account that should not have existed, or the merge that went out without an approver, or the restore that did not restore. What did the person do, who did they tell, where is that recorded, and what changed afterwards.
Three answers show up, and they are not equally good.
It has never failed, and here is what we would see. Honest, and complete if the second half is real: the alert, the dashboard, the person whose job it is to look. The thing that makes this answer work is that the detection path exists independently of whether it has ever fired.
It has never failed. Full stop. True, probably, and it leaves open whether you would know. For a control where failure is silent — a backup that is not being taken, a monitor that stopped reaching anybody — we have never seen a problem and there has never been a problem are different claims and look identical from inside.
It failed in May and here is the record. The best of the three, almost always, and it is the one people are most reluctant to give. A control with a documented failure and a documented response has demonstrated its exception path with an artefact; a control with an unblemished record has demonstrated the happy path only.
Check
There is no shortage of longer lists. Questionnaires run to two hundred items and most of them are a procurement team covering itself.
These three survive because they are the minimum set that cannot be answered with a document. A policy answers what is supposed to happen. Only a named person answers who approved this; only a dated artefact from the middle of the period answers show me the one from March; and only a story with a record attached answers what happened the time it failed.
Which means you can run this on your own register in an afternoon, control by control, and the thin answers you find are the same thin answers somebody else would find. That is the closest thing to a rehearsal available, and it costs nothing but the afternoon.