Evidence Doesn’t Lie, But People Do

Let me tell you a secret.

Most of the time, when someone hands me a perfect file, I get nervous. I don’t trust perfect.

Not because I’m cynical, but because I’ve done this long enough to know the real world is messy. Especially when money’s moving and no one’s watching too closely.

This isn’t about gotchas or paperwork. It’s about one thing. Figuring out what actually happened.
Not what’s claimed. Not what’s printed. What happened.

And sometimes, the only way to do that is with a pencil, a flashlight, and a head that’s not full of assumptions.

I was sent to review payroll at a migrant worker site. On paper, 186 workers were present. But walking the site, I counted about 40.

No biometric system. No digital log. Just a whiteboard, a stack of dusty binders, and a foreman named Carlos who had one answer to every question:

“We pay cash. Everyone gets paid. All done.”

The documents were too clean. The attendance sheets were full. No one ever missed a day. All the signatures looked like they came from the same hand. Because they probably did.

That’s when I stopped reading, and started chasing.

In Auditing Without Power, I talk a lot about tools.
Not the ones that run on apps or battery life.
Just the kind you can carry, sketch, or scribble when the lights are out.

This was a classic Track the Trail moment. The paper told one story, but the footsteps on the ground said something else. My job? Follow the trail until the story broke down.

Here’s what helped me get there:

Evidence Log

Every piece of proof (photo, receipt, overheard comment) got logged with where it came from and why it mattered. Not to fill a spreadsheet. To protect the story.

Risk-Based Sampling

I didn’t pick names at random. I chose the ones that didn’t make sense like round numbers, duplicate dates, people no one recognized.
That’s not bias. That’s good audit thinking.

Fraud Triangle Sketch

Pressure. Opportunity. Justification.
I mapped what might’ve made someone fudge the numbers or look the other way. This wasn’t just fraud, it was routine.

Truth-Check Checklist

What was supposed to happen? Step by step.
Then I looked at what actually happened.
That mismatch? That’s the real finding.

This wasn’t just about who was missing. It was about what was missing from the process.

• No second signer.

• No oversight on cash.

• Fuel logs that didn’t match reality.

This is the second pillar in play. Trace the Controls.

If a control looks good on paper but can’t stop fraud in practice, it’s not a control. It’s set dressing.

I documented everything.

Not just the ghost names. The locked fuel shed. The receipts that had been reused. The buses that hadn’t moved in months.

And I wrote it clearly, using the same format I talk about in the book:

Context. Control. Concern. Effect. Recommendation.

No drama. No fluff. Just fact, cause, and fix.

The agency who hired me tried to delay the release. Said I was being “too speculative.”

But speculation ends when you’ve got 186 names and only 40 people standing in the sun.

So I submitted the report to the board and walked away clean. No heroics. Just the work done right.

We want to believe paperwork. It’s easier. It’s tidy.

But when you audit in places where systems don’t work or weren’t designed to protect people in the first place, you have to think differently. You have to see differently.

That’s what this chapter is about.
That’s what Audit Thinking is about.

Two pillars especially carried this one:

• Track the Trail – Follow the chain from claim to confirmation. If you can’t trace it, don’t trust it.

• Trace the Controls – If it didn’t stop misuse, it wasn’t a real safeguard.

This story comes from Chapter 3 of the book, Auditing Without Power: The Portable Pocketbook for Low-Tech, No-Tech Audits.

It’s not a textbook. It’s a field tool.
But it’s not just for field auditors.

If you work in risk, oversight, compliance or just want to be sharper, faster, and better prepared when systems break down, this book belongs in your kit.

Inside you’ll find:

• Scenarios like this one, grounded in real-world risk

• Printable, pocket-sized tools that work when tech doesn’t

• A simple framework built on five pillars of audit thinking that won’t fail when the Wi-Fi does

Add it to your stack. Pass it to a teammate.
Use it when the portal crashes and all you’ve got is a pencil and your gut.

I once visited a public clinic that had received a large shipment of medical supplies, on paper, anyway.

The inventory logs were immaculate. Every syringe, every test kit, every latex glove accounted for. Stamped, signed, even color-coded.

But when I walked the storage room, shelves were nearly bare. The back wall had new plaster over a hole just big enough to fit a box through.

I didn’t accuse anyone. I just tracked the trail, backward.

One supplier invoice had a duplicate serial number from a different district.

One staff name showed up twice, once here, once 300 miles away.

One delivery log showed a date when the clinic had been closed for fumigation.

Then I traced the controls.

There were no intake verification steps. No independent check between delivery and use.
The same person signed for receipt, approval, and disposal logs.

I didn’t need access to a system.
I just followed what didn’t add up, until it did.

Turns out, the supplies were being resold privately out the back. The paperwork? Designed to distract.

Audit thinking doesn’t live in the documents.
It lives in what the documents are trying to hide.

Have you ever trusted a file that felt too perfect?
What made you question it, and what did you do next?

Share your thoughts in the comments. Your field lessons help make this space sharper for everyone.