Building a Better Auditor: Is it Puzzling or Mysterious?

This riddle, like many puzzles we encounter, has one correct answer. But before we reveal it, let's explore how puzzles and mysteries shape our world — and our work as internal auditors.

Puzzles are everywhere, each with its singular solution waiting to be uncovered. Wordle challenges millions to guess a five-letter word. Escape rooms require one correct sequence of actions to break free. The New York Times Crossword, a combination lock, many math problems, and making the Lego set look just like the box... all puzzles.

Mysteries, on the other hand, are more open-ended. Parents grapple with getting teenagers to stop putting their dirty dishes under the bed (WHY do they do that?). Scientists search for extraterrestrial life, knowing there might be multiple explanations for the signals we receive — or none at all. Which play to call on third and eight in American football, determining what's "fair" in a complex ethical scenario, predicting long-term trends in the S&P 500, or identifying the root causes of a particular spike in crime… all mysteries.

Sometimes, mysteries evolve into puzzles as we gather more information or develop new tools. What was once the great mystery of human genetics has, in many ways, become a complex but solvable puzzle thanks to advancements in DNA sequencing and analysis. However, the reverse rarely occurs. A puzzle doesn't suddenly sprout new possibilities or become more ambiguous.

This distinction is crucial in our field. Mistaking a puzzle for a mystery can introduce unnecessary complexity, wasting time and resources. Conversely, approaching a mystery as if it were a straightforward puzzle might result in overlooking critical nuances, imparting a false sense of certainty to our conclusions, or even being dead wrong.

So how does this puzzle-mystery spectrum play out in internal auditing? Let's start with the puzzle-like aspects of our work. These might be straightforward compliance checks or routine process evaluations. They're important, but often follow a predictable pattern: gather data, analyze, compare to standards, pass or fail, report findings. Like a Sudoku grid, all the pieces are there — we just need to put each thing in its right place.

But then there are the mysteries — the complex, messy issues that keep us up at night (in a good way, mostly). Unlike puzzles, these don't guarantee a single, neat solution. You might start with one question and uncover a web of interconnected issues spanning multiple departments or processes. Consider an auditor evaluating a company's risk management processes. On the surface, it might seem like a straightforward assessment — a puzzle to be solved by comparing practices to established frameworks. However, as the auditor learns more, they might uncover varying risk appetites across departments, policies that are communicated inconsistently, and challenges in quantifying certain risks. There's no single "correct" solution here, but rather a range of potential approaches, each with its own merits and drawbacks.

"Does this control work as intended?" can often be a puzzle. "Are these controls designed to adequately address underlying risks?" is often a mystery.

When looking to hire new internal auditors, my colleague Katie has asked candidates, "Do you prefer problems with one answer or 10?" It's a deceptively simple question that cuts to the heart of what makes internal auditing unique and challenging. If you find comfort in clear-cut solutions, you might often feel frustrated in this work. But if you thrive on complexity and exploring multiple angles, internal auditing might be your professional playground.

There's no right or wrong answer here, and how fitting. But understanding your preference — and recognizing whether you're dealing with a puzzle or a mystery — can help you navigate the challenges and opportunities in our role, including how to audit an area, and just how deep to press.

Personally, I've come to embrace the mysteries. Yes, they can be frustrating, and there's always that nagging feeling that maybe you've missed something. They push us to think creatively, collaborate more effectively, and expand our understanding of the business —with the great humility that comes from knowing there's not always one right answer. And, done well, they may give management far more usable insight than a pass/fail against a framework. This is where real growth happens — both for us as professionals and for the organizations we serve. 

Is your next audit a puzzle waiting to be solved, or a mystery inviting exploration? The answer might just be the key to unlocking your approach — and your success.

Oh, and the answer to our opening riddle? A map. But remember, in internal auditing, the map is just the beginning — the real adventure lies in navigating the mysteries it reveals.