Spy the Lie for New Internal Auditors: Using Deception-Detection Techniques Without Becoming a Human Lie Detector
- John C. Blackshire, Jr.
- 10 hours ago
- 16 min read
The Objective Is Not to Catch People Lying
New internal auditors often enter interviews with two competing concerns.
They want to obtain complete and truthful information, but they do not want to damage the relationship with the person being audited. They may notice that an answer sounds evasive, incomplete, or inconsistent, yet hesitate to pursue the issue because they are unsure whether they are interpreting the behavior correctly.
Spy the Lie: Former CIA Officers Teach You How to Detect Deception, by Philip Houston, Michael Floyd, Susan Carnicero, and Don Tennant, offers a structured approach to recognizing potentially deceptive behavior and asking questions that may elicit more complete information. The methodology grew out of the authors’ intelligence, investigative, polygraph, interviewing, and behavioral-screening experience.
The book can be highly useful to internal auditors, but it must be applied carefully.
An auditor should never conclude that a person lied merely because the person looked nervous, paused before answering, avoided eye contact, or used awkward language. No single behavior proves deception.
For internal auditors, the proper application is:
Potential deception indicators should trigger additional questions and corroborating procedures—not accusations or unsupported conclusions.
The purpose is not to turn every audit interview into an interrogation. It is to help the auditor recognize when an answer may require clarification, verification, or additional evidence.
Why New Auditors Need These Skills
Internal auditors depend heavily on information obtained from people.
During an engagement, an auditor may ask management and employees to explain:
How a process operates
Who performs a control
Why an exception occurred
Whether a policy was followed
Who approved a transaction
How management monitors risk
Whether fraud or misconduct has been reported
Why a corrective action remains incomplete
The answer may be accurate.
It may also be:
Incomplete
Carefully worded
Based on an assumption
Designed to minimize the problem
Intended to redirect the auditor
Factually false
New auditors are particularly vulnerable because they may assume that the process owner’s experience, authority, confidence, or technical vocabulary makes the answer reliable.
It does not.
The auditor’s responsibility is to listen objectively, identify responses that require further examination, and determine what the evidence supports.
The First Lesson: Do Not Rely on Your Intuition
People often believe they can recognize a lie through instinct.
They assume that deceptive people:
Avoid eye contact
Fidget
Appear nervous
Change their tone
Look uncomfortable
Those behaviors may have many explanations.
A person may be nervous because:
The auditor is unfamiliar.
The employee fears being blamed.
The subject is sensitive.
The individual has difficulty communicating.
The interview is occurring before senior management.
English is not the person’s first language.
The employee does not understand the question.
The person is telling the truth but expects not to be believed.
Spy the Lie presents a behavior-based methodology rather than relying on intuition or one stereotypical sign. The authors emphasize recognizing combinations of verbal and nonverbal behaviors and asking questions designed to produce usable responses.
For auditors, this leads to an important discipline:
Observe the response, but test the facts.
A Deception Indicator Is Not Audit Evidence
Suppose an auditor asks:
“Did you independently verify the vendor’s new bank-account information before the payment was released?”
The Accounts Payable employee pauses, repeats the question, and gives a long explanation about the organization’s vendor-management procedures without directly answering.
That response deserves attention.
It does not prove deception.
The auditor should not document:
“The employee displayed deceptive behavior and failed to perform the verification.”
The auditor should document what occurred factually:
“The employee did not provide a direct response concerning whether independent verification was completed for the selected vendor change. The auditor requested the supporting callback documentation.”
The conclusion should then depend on evidence such as:
The vendor-change request
Callback records
System workflow history
Approval documentation
Email correspondence
Payment timing
Access logs
Subsequent management review
Behavior helps the auditor recognize where to probe.
Evidence supports the audit conclusion.
Look for Behavior in Response to the Question
One practical lesson from the book is to focus on behavior that occurs in direct response to a question.
During an audit interview, the auditor should consider:
Was the question understood?
Did the person answer the question asked?
Did the response shift after a sensitive subject was introduced?
Did several unusual behaviors appear together?
Does the response conflict with prior information?
Is the explanation supported by available evidence?
This is more useful than attempting to classify the person generally as truthful or deceptive.
An employee may be open and accurate about most of the process but become evasive when discussing:
A specific override
A missing approval
A related-party vendor
A delayed reconciliation
A management instruction
An unauthorized system change
The auditor should evaluate the response to the specific question—not the employee’s overall personality.
Use Clusters, Not Isolated Behaviors
One of the most important practical concepts associated with the book is the need to consider clusters of indicators rather than one isolated behavior.
For example, an auditor asks:
“Were any invoices entered after the accounting period was closed?”
The controller:
Delays answering.
Repeats part of the question.
Provides a lengthy explanation of the normal closing process.
States that the accounting team is highly experienced.
Never directly says whether invoices were entered after closing.
No individual element proves dishonesty.
Together, they indicate that the auditor has not received a clear answer.
The appropriate response is not:
“You are lying.”
It is:
“I understand the normal procedure. My question concerns whether any invoices were entered after the period was closed. Were there any?”
Then:
“Please provide the post-close entry report and the system activity for the period.”
The cluster tells the auditor to stay with the subject.
Verbal Behaviors Often Matter More Than Body Language
New auditors can become overly focused on facial expressions, posture, and eye contact.
The words used may provide more actionable information.
Potentially significant verbal patterns include:
Failure to answer the question
Answering a different question
Repeating the question before responding
Excessive qualifications
Overly broad denials
Unnecessary explanations
Invoking personal character instead of addressing facts
Minimizing the issue
Blaming others
Referring vaguely to what “normally” occurs
Using language that distances the speaker from the transaction
These are not proof of deception.
They help identify where the response lacks precision.
Watch for Failure to Answer
The most obvious warning sign is sometimes overlooked: the person does not answer the question.
Auditor’s question
“Did you approve this journal entry?”
Response
“All journal entries go through our established approval process, and our accounting team understands the importance of proper documentation.”
That sounds reassuring.
It does not answer the question.
The auditor should say:
“I understand the established process. Did you personally approve this specific journal entry?”
If the answer remains unclear:
“What record would demonstrate who approved it?”
A new auditor should not allow a confident explanation of the general process to substitute for an answer about the specific transaction.
Recognize Non-Answer Statements
A person may offer a statement that sounds relevant without addressing the factual question.
Question
“Did anyone instruct you to change the transaction date?”
Response
“I would never intentionally misstate the company’s records.”
That response addresses character or intent.
It does not answer whether an instruction was received.
The auditor should return to the question:
“I am not asking you to characterize your intent. Did anyone instruct you to change the date?”
This type of disciplined follow-up is one of the most valuable interviewing habits a new auditor can develop.
Be Alert to Overly Broad Denials
Broad denials can avoid addressing the narrow issue under examination.
Auditor’s question
“Did you use the purchasing card to buy the gift cards identified in this report?”
Response
“I have never stolen anything from this organization.”
The response denies theft generally.
It does not answer whether the person purchased the gift cards.
A more precise follow-up is:
“Did you use the purchasing card to make these specific purchases?”
Then identify each transaction.
Auditors should frame questions narrowly enough that the answer can be verified.
Listen for Qualifiers
Words such as these may reduce the certainty of a statement:
Usually
Normally
Generally
Basically
To the best of my knowledge
As far as I remember
I believe
Probably
Most of the time
Essentially
Qualifiers are not inherently deceptive. Professionals often use them appropriately when their knowledge is limited.
But they should prompt clarification.
Response
“We normally perform an independent callback for vendor-bank changes.”
Follow-up questions
“Under what circumstances is a callback not performed?”
“Who can approve an exception?”
“How frequently did exceptions occur during the audit period?”
“How are callbacks documented?”
“Which report identifies changes completed without verification?”
The qualifier may reveal that the stated control is not universal.
Pay Attention to Convincing Statements
A person may attempt to persuade the auditor of their honesty rather than answering the question.
Examples include:
“I have worked here for 25 years.”
“Everyone knows I am meticulous.”
“I would never risk my career.”
“You can ask anyone in the department.”
“I am the person who wrote the policy.”
“I have nothing to hide.”
These statements may be true.
They are not evidence about the transaction or control.
The auditor should acknowledge the statement without allowing it to derail the interview:
“I appreciate your experience. I still need to understand what occurred with this transaction.”
Long service and a good reputation should never substitute for audit evidence.
Watch for Minimization
People may reduce the apparent importance of an issue through language such as:
It was only one transaction.
The amount was small.
No one lost any money.
It was merely a documentation issue.
We fixed it immediately.
The external auditors did not raise it.
It did not affect the financial statements.
Minimization may be accurate, or it may be an attempt to influence the auditor before the facts have been established.
The auditor should separate:
What occurred
Why it occurred
How often it occurred
What risk existed
Whether the issue was detected by the control
Whether similar items exist in the population
The absence of a known loss does not prove that the control was effective.
Recognize Blame Shifting
A person may redirect responsibility to:
Another employee
The system
A vendor
Prior management
Lack of training
Insufficient staffing
The written policy
Internal Audit
Blame shifting does not necessarily mean the statement is false. Responsibility may genuinely be shared or unclear.
But the auditor should convert the blame into testable questions.
Response
“IT never removed the former employee’s access.”
Follow-up questions
“Who was responsible for notifying IT?”
“When was the termination submitted?”
“What evidence shows that IT received it?”
“Who was responsible for verifying completion?”
“Did the employee use the access after termination?”
“Does the same issue affect other terminated employees?”
The auditor’s job is to understand the process failure, not referee personal accusations.
Observe Verbal and Nonverbal Disconnects Carefully
The book discusses verbal and nonverbal behaviors that may conflict.
For example, a person may say “no” while appearing to nod, or verbally agree while showing visible resistance.
These behaviors should be interpreted cautiously. Cultural differences, habits, stress, and misunderstanding may all affect nonverbal behavior.
For auditors, a disconnect should produce clarification:
“I want to make sure I understood your answer. Are you saying that no override occurred?”
Ask for a clear verbal response and corroborating evidence.
Do not make a finding from body language.
Establish the Normal Process Before Exploring the Exception
A new auditor should first understand how the process is intended to operate.
This creates a reference point for exploring differences.
For example:
“Walk me through the standard process for adding a vendor.”
“Who can approve the vendor?”
“How is the vendor authenticated?”
“What evidence is retained?”
“What happens when the request is urgent?”
“Describe the last time the normal process was not followed.”
The final question moves from the general process to the exception.
This technique is especially effective during walkthroughs because people may explain the ideal process even when actual practice contains significant workarounds.
Ask Direct, Simple Questions
Complicated questions produce complicated answers.
Avoid:
“Considering the policy requirement, the recent system implementation, and the staffing shortages that management discussed, can you explain whether the monthly account review was properly completed and whether any significant exceptions were noted or communicated?”
That is several questions disguised as one.
Use a sequence:
“Was the review completed?”
“Who completed it?”
“When?”
“What evidence was retained?”
“What exceptions were identified?”
“Who was informed?”
“How were the exceptions resolved?”
Direct questions make evasive answers easier to recognize and factual answers easier to verify.
Avoid Leading Questions
A leading question tells the interviewee what answer the auditor expects.
Leading question
“The reconciliation was reviewed monthly, correct?”
This encourages agreement.
Better question
“How frequently was the reconciliation reviewed?”
Then:
“Show me the evidence for the months selected.”
Similarly, avoid:
“This was simply an isolated mistake, wasn’t it?”
Use:
“What evidence supports the conclusion that this was isolated?”
Neutral questions protect the auditor from confirmation bias.
Ask One Question at a Time
New auditors sometimes ask several questions simultaneously because they want to appear prepared.
For example:
“Who prepared the report, who reviewed it, what exceptions were identified, and how did management resolve them?”
The interviewee may answer only the easiest part.
Ask separately:
Who prepared the report?
Who reviewed it?
What did the reviewer examine?
What exceptions were identified?
How were they resolved?
What evidence was retained?
This improves both the interview and the workpaper.
Allow Silence to Work
New auditors often become uncomfortable with silence.
After asking a difficult question, they may:
Rephrase it immediately
Offer possible answers
Change the subject
Explain why the issue may not be serious
Rescue the interviewee from discomfort
That weakens the question.
Ask the question clearly and allow the person time to respond.
A pause may indicate many things, including careful thought, confusion, stress, or an attempt to construct an answer. The auditor should not interpret the pause alone as deception.
But the auditor should not fill it.
Use Follow-Up Questions That Require Specificity
Useful follow-ups include:
“What do you mean by ‘normally’?”
“Which transactions are excluded?”
“Who made that decision?”
“When did that occur?”
“How do you know?”
“What evidence supports that statement?”
“Who else was involved?”
“What happened next?”
“Was the same procedure followed throughout the year?”
“Are there any exceptions you have not described?”
Specific questions reduce the opportunity for vague answers.
Ask for the Story in Reverse or from Different Perspectives
When an issue is significant, the auditor may test the consistency of the account by asking about the process from a different starting point.
For example:
First trace the transaction from requisition to payment.
Then trace the evidence backward from payment to authorization.
Interview different control owners separately.
Compare system records with each person’s description.
The objective is not to trick the interviewee.
It is to determine whether the explanation remains consistent with the process and evidence.
Contradictions may reveal:
Different understandings of responsibility
Unrecorded workarounds
Process changes
Incomplete communication
Potential deception
Separate Deception from Error, Confusion, and Poor Memory
Not every inaccurate statement is a lie.
A person may be wrong because:
The process recently changed.
The employee misunderstood the question.
The individual has limited knowledge.
Records are incomplete.
The event occurred long ago.
Responsibilities are unclear.
The person is relying on someone else’s explanation.
The employee genuinely misremembered.
Deception generally involves an intention to mislead.
An auditor may not be able to establish intent through an interview alone.
The workpaper should therefore focus on supportable facts.
Instead of:
“The manager lied about completing the review.”
Use:
“The manager stated that all monthly reviews were completed. The available records showed evidence of review for four of the twelve months examined.”
That language is factual, objective, and defensible.
Do Not Label the Interviewee a Liar
The word “lie” carries serious consequences.
Using it without adequate evidence can:
Damage reputations
Create legal exposure
Undermine the investigation
Cause the employee to stop cooperating
Introduce bias into the audit
Damage Internal Audit’s credibility
Internal Audit reports should describe:
Statements made
Evidence obtained
Inconsistencies identified
Procedures performed
Conclusions supported
Possible language includes:
“The explanations were inconsistent.”
“The statement was not supported by available documentation.”
“The employee’s description differed from the system records.”
“Additional evidence could not be provided.”
“The matter was referred for further investigation.”
Let the evidence establish the nature of the issue.
Apply Professional Skepticism Without Treating Everyone as Dishonest
Professional skepticism requires a questioning mind and critical assessment of evidence.
It does not require hostility or automatic distrust.
An auditor who assumes everyone is lying may:
Misinterpret ordinary nervousness
Ask accusatory questions
Damage cooperation
Ignore evidence supporting management
Create confirmation bias
Overstate findings
An auditor who assumes everyone is truthful may:
Accept unsupported explanations
Miss contradictory evidence
Fail to investigate exceptions
Rely excessively on reputation
Understate fraud risk
The correct posture is neither suspicion nor trust.
It is verification.
Use the Book’s Techniques During Walkthroughs
Walkthroughs are especially well suited to structured deception-awareness techniques.
Consider a procure-to-pay walkthrough.
The employee states:
“The system requires all invoices to be matched to a purchase order and receiving record.”
The auditor should ask:
“Are any invoice categories excluded?”
“How are professional-service invoices processed?”
“Can the match be overridden?”
“Who has override access?”
“What report identifies overrides?”
“Who reviews that report?”
“Show me the selected transaction.”
“Describe the last time an invoice was paid without a complete match.”
The initial statement may accurately describe the control design.
The follow-up questions reveal how the control operates when the normal process does not fit the transaction.
Use the Techniques When Discussing Audit Exceptions
Suppose the auditor identifies five invoices without required approval.
Management states:
“These were all emergency purchases.”
The auditor should not immediately accept or reject the explanation.
Follow-up questions include:
“How does the policy define an emergency?”
“Who determined that each purchase met that definition?”
“When was the approval obtained?”
“What documentation is required?”
“Are emergency purchases reported to management?”
“How many emergency purchases occurred during the year?”
“Were these five purchases made by the same employee or department?”
“What prevented normal approval?”
The response becomes a hypothesis to test.
Use the Techniques During Fraud-Risk Interviews
Fraud-risk discussions often generate predictable responses:
“Fraud could never happen here.”
“We trust our employees.”
“The amounts are too small.”
“The system would detect it.”
“The external auditors test that.”
“We have never had a problem.”
These statements should lead to more specific questions:
“Which fraud schemes has management evaluated?”
“Who can override the controls?”
“What reports identify unusual activity?”
“When was the last fraud risk assessment?”
“Which fraud indicators have appeared during the past year?”
“How are allegations investigated?”
“What controls would detect collusion?”
“What risks remain after existing controls?”
The auditor is not accusing anyone.
The auditor is moving the discussion from confidence to evidence.
Document the Interview Objectively
A high-quality interview workpaper should include:
Date and location
Participants
Purpose
Questions or subjects covered
Significant statements
Documents identified
Evidence inspected
Inconsistencies
Follow-up procedures
Auditor conclusions
Avoid documenting subjective impressions such as:
“The employee looked guilty.”
“The response seemed suspicious.”
Use factual descriptions:
“The manager did not answer whether the approval occurred.”
“The manager provided three different dates for the transaction.”
“The stated reviewer differed from the user identified in the system log.”
“Supporting documentation was requested but not provided.”
“The auditor expanded testing based on the inconsistent responses.”
That documentation can be reviewed and defended.
New Auditors Must Manage Their Own Biases
The person most likely to distort the interview may sometimes be the auditor.
Potential biases include:
Confirmation Bias
Looking only for evidence supporting the preliminary finding.
Halo Effect
Assuming a respected executive is reliable in every matter.
Horn Effect
Assuming a difficult employee is dishonest.
Authority Bias
Accepting a statement because it came from senior management.
Anchoring
Relying too heavily on the first explanation received.
Availability Bias
Assuming the current case resembles a memorable prior fraud.
The auditor should ask:
What evidence would disprove my current theory?
Have I interpreted neutral behavior as deception?
Did I ask leading questions?
Have I considered innocent explanations?
Am I applying the same standard to all interviewees?
Does the evidence support the conclusion?
The book’s methodology is most useful when paired with disciplined self-awareness.
Know When the Matter Has Become an Investigation
A routine audit interview may reveal:
Intentional falsification
Possible theft
Management override
Destruction of records
Collusion
Retaliation
Regulatory violations
Potential criminal conduct
At that point, the auditor should not continue improvising.
The organization may need to involve:
The Chief Audit Executive
Legal counsel
Human Resources
Compliance
Security
A Certified Fraud Examiner
External specialists
Law enforcement
The audit team should protect evidence and follow approved investigation protocols.
A new auditor should understand their limits.
Recognizing possible deception is not the same as being qualified to conduct a formal interrogation or fraud investigation.
A Practical Interview Framework for New Auditors
Before the interview:
Define the objective.
Review available documentation.
Identify known facts.
Identify missing information.
Prepare direct, neutral questions.
Determine what evidence should exist.
Arrange for an appropriate second auditor when the subject is sensitive.
During the interview:
Explain the purpose.
Establish the normal process.
Ask one question at a time.
Listen for direct answers.
Note clusters of unusual responses.
Clarify qualifiers and vague terms.
Do not interrupt silence unnecessarily.
Request supporting evidence.
Avoid accusations.
Summarize your understanding.
After the interview:
Compare statements with records.
Identify contradictions.
Perform follow-up procedures.
Consider alternative explanations.
Consult supervision.
Document facts objectively.
Escalate suspected misconduct appropriately.
Example: The Missing Reconciliation
An auditor asks the Accounting Manager:
“Was the bank reconciliation completed and reviewed for March?”
The manager responds:
“We have an experienced accounting staff, and reconciliations are one of our most important controls. The team understands that these must be completed each month.”
The response sounds positive but does not answer the question.
The auditor follows up:
“Was the March reconciliation completed?”
The manager says:
“I believe so. We had staffing problems around that time.”
The auditor continues:
“Who prepared it?”
“Who reviewed it?”
“Where is it retained?”
“What unresolved differences were identified?”
“Please provide the reconciliation and evidence of review.”
The auditor later learns:
No March reconciliation exists.
The employee responsible had resigned.
No backup responsibility was assigned.
The account was not reconciled until June.
Several unusual items remained unresolved.
The audit finding should not state that the manager lied.
It should state the control condition, cause, risk, and evidence.
The questioning techniques helped the auditor recognize that the initial response did not answer the question.
Example: The Vendor Conflict
An auditor asks a procurement employee:
“Do you have any personal or financial relationship with the vendor?”
The employee immediately responds:
“I would never do anything that violated our ethics policy.”
The auditor says:
“I understand. Do you have any personal or financial relationship with this vendor?”
The employee acknowledges that the vendor is owned by a relative but states that the relationship was disclosed verbally to a former manager.
The auditor then requests:
Conflict-of-interest disclosures
Vendor onboarding records
Bid documentation
Approval history
Payments to the vendor
Communications with management
Again, the technique does not prove misconduct.
It allows the auditor to obtain a direct answer and identify the evidence needed.
The Most Important Lesson for New Auditors
The value of Spy the Lie is not that it gives auditors a magical ability to identify liars.
It does not.
Its practical value is that it teaches auditors to:
Listen more carefully
Recognize nonresponsive answers
Remain with the question
Observe combinations of behaviors
Avoid relying entirely on intuition
Ask clearer follow-up questions
Separate statements from evidence
Seek corroboration
The auditor should never confuse an indicator with a conclusion.
A behavior may cause the auditor to ask another question.
Only evidence should cause the auditor to make an audit finding.
Using Spy the Lie Responsibly in Internal Auditing
New internal auditors should use the book as a guide for improving:
Audit interviews
Walkthroughs
Fraud-risk discussions
Exception follow-up
Root-cause analysis
Management meetings
Corrective-action validation
They should not use it to:
Diagnose deception from body language
Label employees as dishonest
Conduct unauthorized interrogations
Replace audit testing
Avoid corroborating evidence
Make findings based on personal impressions
The proper sequence is:
Observe. Clarify. Corroborate. Conclude.
That sequence protects the organization, the interviewee, and the auditor.
Building the New Auditor’s Professional Judgment
A new auditor’s first responsibility is not to prove that someone is wrong.
It is to understand what happened.
That requires the auditor to:
Ask direct questions
Listen without prejudging
Recognize when the answer is incomplete
Request the evidence
Resolve contradictions
Document conclusions fairly
Spy the Lie can help auditors become more attentive and disciplined interviewers. The book’s published description emphasizes both recognition of verbal and nonverbal deceptive behaviors and the use of questioning techniques intended to elicit truth.
But the internal auditor must add the professional safeguards that auditing requires:
Objectivity
Due professional care
Corroboration
Supervision
Documentation
Respect for individual rights
Evidence-based reporting
A skilled auditor does not leave an interview thinking:
“I know that person lied.”
The skilled auditor leaves thinking:
“That answer did not resolve the question. Here is the additional evidence I need.”
That is the difference between suspicion and professional skepticism.
Comments