From Finding Problems to Solving Them
From Finding Problems to Solving Them
How Problem-Solving Skills Can Transform Internal Audit
Internal auditing is often associated with identifying errors, control weaknesses, compliance gaps, and irregularities. But identifying a problem is only the beginning. The real value of internal audit comes when we can understand why the problem occurred, what risk it creates, and how it can be addressed in a sustainable way. This became much clearer to me after attending a training session on Problem-Solving Skills for Internal Auditors, conducted by my Head of Department during the last financial year. Among the training sessions I attended, this particular session has had a meaningful impact on the way I look at audit observations and recommendations.
From Finding to Understanding
An audit observation usually starts with a deviation from an expected condition. It could be an inventory discrepancy, a missing approval, a process violation, an inaccurate financial record, or a control that is not operating as intended. Identifying that deviation is important. But stopping there may only tell us what happened. Effective problem solving requires us to go further and understand the underlying cause. The training introduced a structured approach:
Monitor → Identify → Define → Understand → Identify Root Cause → Corrective Action
This framework helped me look at audit issues not merely as isolated exceptions, but as problems that need to be understood in context.
Root Cause Matters
One of the concepts I found particularly useful was Root Cause Analysis (RCA). In auditing, the first explanation we discover is not always the root cause. For example, imagine an audit identifies a duplicate vendor payment. The immediate cause may appear to be that an invoice was processed twice. But further analysis may reveal multiple underlying weaknesses: duplicate invoice entry, inadequate system configuration, insufficient validation, or weaknesses in user acceptance testing.
The training demonstrated how tools such as 5 Whys and the Fishbone Diagram can help auditors move beyond the immediate symptom and identify deeper causes. This distinction is important because correcting the symptom does not necessarily eliminate the risk. If the root cause remains, the same problem can return.
A Recommendation Should Address the Cause
This also changed the way I think about audit recommendations. A recommendation should not simply say: Management should ensure compliance with the existing procedure. It should address the underlying reason for the weakness. The training emphasized developing corrective actions that are Specific, Measurable, Achievable, Realistic, and Timely.
Get Amitav Barman’s stories in your inbox
Join Medium for free to get updates from this writer.
A good recommendation should therefore provide management with a practical direction for improvement rather than simply restating the requirement. For me, this is an important distinction between reporting an issue and adding value through an audit.
Problem Solving and Risk-Based Auditing
Problem-solving skills are also closely connected with risk-based auditing. An internal auditor cannot always examine every transaction or every item in a population. Audit resources are limited, so professional judgment becomes essential. The training covered risk-based and stratified sampling approaches, where greater attention can be given to high-value or high-risk areas while appropriate methods are applied to other populations. This reinforced an important principle for me:
Effective auditing is not necessarily about checking more. It is about focusing better.
Understanding where the greatest risks exist helps us design more meaningful audit procedures and use our resources more effectively.
Problem Solving Goes Beyond Financial Issues
Another valuable learning was that audit-related problems are not always financial. Auditors may face restricted access to information, limited availability of records, technology constraints , scope restrictions, or difficulties in obtaining sufficient audit evidence. The training discussed how such scope limitations can be addressed through practical alternatives, technical workarounds, and, where necessary, appropriate escalation through governance channels. This reminded me that professional problem solving is also about protecting the integrity and effectiveness of the audit process itself.
From Compliance Checking to Value Addition
Perhaps the biggest takeaway for me is the difference between checking whether a control exists and assessing whether the control actually works.
- A policy may exist.
- A document may be available.
- An approval may have been obtained.
But these alone do not necessarily mean that the underlying risk has been adequately controlled. A stronger audit approach looks at whether the control is actually achieving its intended purpose. This perspective aligns with the broader role of internal audit as a function that can contribute not only through assurance, but also through meaningful, risk-focused recommendations and improvement opportunities.
What Changed in My Approach?
This training did not simply give me another audit technique. It encouraged me to develop a different mindset. When I encounter an audit observation, I now try to look beyond the immediate exception and understand the broader context. A visible problem may be the result of a process weakness. That process weakness may be linked to a system limitation. The system limitation may originate from inadequate implementation, monitoring, ownership, or governance. Understanding those connections can lead to a much stronger audit conclusion. It can also lead to recommendations that are more practical and sustainable.
The Real Value of an Auditor
I believe the role of an internal auditor goes beyond finding faults. A good audit identifies weaknesses. A better audit explains the risks. And a value-adding audit helps management understand the root cause and the practical path toward improvement. That is why I now see problem-solving as more than a professional skill. For an internal auditor, it is a mindset.
Finding a problem is an audit activity. Understanding its root cause is professional judgment. Helping prevent its recurrence is where internal audit creates value.
A Note of Appreciation
I would like to sincerely thank my Head of Department for conducting this valuable training on Problem-Solving Skills for Internal Auditors and for sharing practical knowledge and experience. Among the training sessions I attended during the last financial year, this particular session has been especially useful to me. It has influenced the way I think about audit observations, root cause analysis, recommendations, and risk. Most importantly, it reminded me that the best audit outcome is not simply identifying what went wrong, but helping the organization understand why it went wrong and how it can be prevented from happening again.
