Imagine a detective arriving at a crime scene.
Would they immediately focus on a single fingerprint?
Would they spend hours examining one receipt?
Would they conclude an investigation after looking at one piece of evidence?
Of course not.
A detective studies people before studying paperwork.
They observe patterns.
They identify motives.
They connect seemingly unrelated events.
They understand behavior.
The same principle applies to internal auditing.
Many organizations believe auditors examine invoices, purchase orders, expense claims, or inventory records.
In reality, those documents are merely evidence.
The real subject of every audit is human behavior.
Invoices don’t commit fraud.
People do.
Purchase orders don’t bypass controls.
People do.
Systems rarely fail on their own.
People interact with systems in ways that create risk.
That is why great auditors think more like detectives than accountants.
Every Document Tells a Human Story
An invoice looks like numbers on paper.
To an experienced internal auditor, it tells a story.
Who approved it?
Why was it approved?
Was it approved unusually quickly?
Was the vendor recently created?
Were competitive quotations obtained?
Was the purchase necessary?
Did the timing coincide with month-end?
Behind every document lies a sequence of human decisions.
Auditors don’t simply verify whether the invoice exists.
They ask why it exists.
The Difference Between Checking and Investigating
There’s a significant difference between reviewing documents and investigating behavior.
A checklist-based audit might ask:
- Is the invoice approved?
- Is the amount correct?
- Is GST calculated correctly?
- Is supporting documentation attached?
A detective-minded auditor asks different questions:
- Why was this vendor selected?
- Why was approval unusually fast?
- Why did this purchase occur just below the approval threshold?
- Why do similar purchases repeatedly happen at month-end?
- Why does one employee consistently approve exceptions?
The first approach validates transactions.
The second reveals risk.
People Always Leave Behavioral Evidence
Every decision leaves traces.
Not physical fingerprints.
Behavioral fingerprints.
Just as detectives reconstruct events from evidence, auditors reconstruct business activities from operational patterns.
Consider a simple procurement process.
An employee requests materials.
A manager approves the request.
Procurement creates a purchase order.
The vendor delivers goods.
Finance processes payment.
Each step creates evidence.
Not just documents.
Behavior.
The Behavioral Clues Auditors Should Notice
Great auditors pay attention to recurring patterns that others ignore.
Approval Patterns
Does one manager approve nearly every urgent request?
Are approvals consistently given within seconds?
Do approvals frequently occur outside working hours?
Behavior often reveals weaknesses long before financial losses appear.
Purchasing Patterns
Does one department repeatedly split purchases below approval limits?
Do emergency purchases occur every month?
Are the same vendors consistently selected?
Patterns matter more than individual transactions.
Vendor Patterns
New vendors suddenly receiving large contracts.
Vendor addresses matching employee addresses.
Multiple vendors sharing bank accounts.
Inactive vendors becoming active at year-end.
These are not isolated anomalies.
They’re behavioral indicators.
Expense Patterns
Frequent claims just below reimbursement limits.
Repeated weekend travel expenses.
Identical receipt formats.
Round-number expense claims.
One unusual expense means little.
A recurring pattern deserves attention.
Fraud Rarely Starts with Numbers
Most fraud investigations don’t begin because someone noticed an incorrect total.
They begin because someone noticed unusual behavior.
Perhaps:
- An employee refused to take annual leave.
- A procurement officer insisted on using one supplier.
- A finance executive resisted role rotation.
- Inventory adjustments suddenly increased.
- Manual journal entries became more frequent.
These are behavioral warning signs.
The financial impact usually comes later.
Auditing Behavior Means Understanding Motivation
Detectives don’t only ask:
“What happened?”
They ask:
“Why did it happen?”
Internal auditors should do the same.
People rarely violate controls without reason.
Sometimes the motivation is financial.
Sometimes it’s pressure.
Sometimes it’s convenience.
Sometimes it’s poor process design.
For example:
An employee bypasses procurement because purchasing takes two weeks.
Is the employee violating policy?
Yes.
Is the real problem the employee?
Maybe not.
The actual issue may be an inefficient procurement process.
Behavior often exposes broken systems.
The Four Behavioral Questions Every Auditor Should Ask
Instead of beginning with documents, begin with behavior.
1. Who Benefits?
Every unusual transaction creates value for someone.
Identify who gains.
Follow the incentive.
2. What Changed?
Stable processes rarely produce sudden anomalies.
Look for:
- new vendors
- new approvers
- policy changes
- staff transfers
- system upgrades
Behavior changes before numbers change.
3. Is This Normal?
Normal behavior creates predictable patterns.
Risk often appears as deviation.
One unusually large payment.
One unexpected journal entry.
One approval outside policy.
One exception may not matter.
Repeated exceptions almost always do.
4. Why Did It Make Sense to Them?
This is the most powerful question.
People usually believe they’re making a reasonable decision.
Understanding their reasoning often reveals weaknesses in controls, incentives, or governance.
Data Analytics Makes Behavioral Auditing Stronger
Modern internal audit has moved beyond manual sampling.
Today’s auditors use:
- Process mining
- Continuous auditing
- ERP analytics
- AI-assisted anomaly detection
- Benford’s Law analysis
- Duplicate payment detection
- Exception reporting
These tools don’t replace professional judgment.
They amplify it.
Instead of reviewing 100 invoices, auditors can analyze 100,000 transactions and identify behavioral patterns hidden within the data.
Technology helps answer:
Who consistently approves exceptions?
Which vendors always receive emergency purchases?
Which departments repeatedly override system controls?
Behavior becomes visible through data.
Why Internal Controls Should Focus on Behavior
Many organizations strengthen documentation without strengthening behavior.
They create:
- more forms,
- more signatures,
- more approvals,
- more policies.
Yet fraud continues.
Why?
Because documents don’t make decisions.
People do.
Effective internal controls influence behavior by:
- separating responsibilities,
- limiting access,
- automating approvals,
- monitoring exceptions,
- creating accountability,
- encouraging transparency.
Good controls don’t simply record behavior.
They shape it.
The Detective’s Mindset in Internal Audit
A detective enters a room asking:
“What doesn’t fit?”
An internal auditor should do exactly the same.
Why are there three purchase orders instead of one?
Why was this vendor created yesterday?
Why was inventory adjusted just before stock verification?
Why are manual journal entries increasing?
Every “why” leads closer to the root cause.
The goal isn’t to catch people.
The goal is to understand systems through the behavior they produce.
From Compliance to Curiosity
Traditional auditing often focuses on compliance.
Were procedures followed?
Were approvals obtained?
Were policies documented?
Behavioral auditing goes one step further.
It asks:
Why did employees behave this way?
What incentives drove these decisions?
What weaknesses encouraged policy violations?
How can the system make the right behavior the easiest behavior?
That shift transforms internal audit from an inspection function into a strategic advisory function.
Final Thoughts
A detective doesn’t solve a case by collecting the most evidence.
They solve it by understanding the story the evidence tells.
Internal auditors should think the same way.
Invoices, purchase orders, approvals, inventory records, and financial reports are not the destination.
They are clues.
The real investigation is about the people, processes, and incentives that created them.
When auditors stop auditing paperwork and start auditing behavior, they uncover risks long before they appear in financial statements.
Because every organization leaves evidence everywhere.
The question is not whether the evidence exists.
The question is whether the auditor knows how to read it.