I don’t just enjoy movies for my annual October Movie Monster-fest. I have been reading Tom Mead’s Joseph Spector mysteries, and the puzzles have brought me back to a question every compliance professional should recognize: What happens when the evidence shows that something occurred, but everyone insists the controls made it impossible?
Imagine an unauthorized payment. Finance says two approvals were required. Technology says access was restricted. Management says the procedures were clear. Yet the money left the company. There is your locked room.
John Dickson Carr offers a useful starting point. In Chapter 17 of The Hollow Man, his detective, Dr. Fell, describes seven categories of locked-room mystery. These are explanations of apparently impossible events, not seven mandatory writing rules or a compliance framework. Nevertheless, they invite a productive investigative habit: challenge the assumptions that make the evidence seem impossible. (See 7 Types of Locked Room Mystery)
Spoiler notice: This article discusses locked-room mechanisms that may reveal how some mystery plots work.
1. An Accident That Looks Like Murder: Test the Premise
Fell’s first category in The Hollow Man removes the murderer altogether. A fatal accident inside the room creates circumstances that suggest murder. The investigator, searching for an ingenious escape route, tries to explain something that never happened. That is a useful warning for internal investigations. Before asking how an employee defeated a control, establish whether anyone deliberately defeated it.
Consider a hypothetical duplicate payment. An investigator might suspect collusion between an employee and a supplier. But the explanation could be a poorly configured system, an ambiguous invoice reference, or overlapping responsibilities during a transition. Those possibilities require different evidence and different remediation.
The point is not to excuse misconduct. It is to avoid treating the allegation as the conclusion. An investigation should test competing explanations, including evidence that contradicts its opening theory. Finding an error rather than fraud should refine accountability, not end the inquiry.
Ask: What evidence would distinguish deliberate misconduct from error or process failure?
2. Poison Gas: Examine the Environment
In the second category, Fell describes poison gas overcoming the victim. The resulting distress may disturb the furniture, making it look like a struggle with an attacker. The room tells a story, but the apparent story misidentifies the cause. My compliance parallel is the operating environment.
Imagine investigators discovering that several analysts bypassed required reviews. Focusing only on individual decisions might produce several disciplinary recommendations. Looking at the environment could reveal something else: supervisors demanding immediate clearance, unresolved staffing requests, and employees learning that escalation brings criticism rather than assistance.
Those conditions would not automatically excuse individual decisions. They would become additional hypotheses to investigate. The mistake is to attribute a pattern entirely to personal failings without examining the conditions in which people worked. Another training module may address neither the workload nor the managerial instructions.
Ask: What pressures, incentives, and supervisory behaviors surrounded the decisions under investigation?
3. The Mechanical Trap: Look Before the Event
Fell’s third category in The Hollow Man involves a trap placed in the room and activated later by the victim. The murderer can be elsewhere when the fatal event occurs. An investigator who focuses only on who was present at that moment starts with an unnecessarily narrow timeline. The compliance equivalent is a process altered before an apparently routine transaction.
Suppose someone changes a supplier’s payment information. Weeks later, an ordinary payment run uses that information. The employees processing the payment may follow their assigned steps while relying on a record whose integrity was compromised earlier. The investigative question is therefore larger than who approved the final transaction. Who established the underlying data? Who could change it? What evidence shows which version the approvers saw? Do not confuse the moment a loss becomes visible with the moment its cause was introduced. Review the relevant changes, permissions, and dependencies leading up to the event.
Action: Reconstruct the setup as carefully as the execution.
4. Suicide Disguised as Murder: Challenge the Attribution
The fourth category concerns a suicide arranged to resemble murder, potentially to incriminate an innocent person. In Fell’s discussion, the apparent crime scene is not merely evidence of an event. It attempts to direct the investigator toward a particular explanation. The compliance analogy is staged attribution, not the death itself.
Consider a hypothetical manager who instructs an employee outside the formal workflow to process an exception. The employee’s name remains in the system. The manager subsequently presents that record as proof that the employee acted alone. The record might be authentic and still tell an incomplete story.
An investigator should examine who created the evidence, what it actually establishes, and what surrounding communications may qualify it. Neither a senior executive’s account nor a compelling accusation should substitute for corroboration. Apply that discipline without treating a reporting employee as presumptively unreliable.
Ask: Does this evidence establish responsibility, or merely show whose name appears in the file?
5. Impersonation After Death: Separate Identity from Appearance
In Fell’s fifth category, the murderer impersonates a victim who has already been killed. Observers believe they have seen the victim alive, placing the death later than it actually occurred. Identity and chronology reinforce the same mistaken conclusion. For compliance professionals, the analogy is an approval that appears to establish more than it does.
Imagine a transaction record carrying a director’s username. Does that prove the director personally reviewed the transaction? Before answering, examine delegated authority, account access, and how any automated workflow operates. A legitimate delegation and an unauthorized use could produce superficially similar records.
The timestamp needs equal attention. Does it record the decision, the system entry, or a later processing step? The mistake is turning a familiar name and precise-looking time into unquestioned proof. Precision in a record is not the same as certainty about its meaning.
Action: Verify the actor, authority, and meaning of the timestamp before assigning accountability.
6. Murder from Outside the Room: Reconsider the Boundary
Fell’s sixth category allows the murderer to act from outside while circumstances suggest that the killing required someone inside. The apparent impossibility depends on a mistaken assumption about where the attacker needed to be. This offers an analogy for control boundaries.
Imagine a restricted finance application receiving supplier information from another system. Investigators confirm that nobody improperly accessed the finance application and conclude that the transaction could not have been manipulated. But that conclusion leaves the incoming information unexamined.
Follow the transaction upstream. What information did procurement, an outsourced service provider, or a business partner provide? Which team validated it? What changes could occur before the finance control began operating?
A control may function as designed within its boundary while leaving a consequential dependency outside the investigation. The appropriate response isn’t necessarily to abandon the control but to understand and address that dependency.
Ask: What can influence this process without passing through the control we tested?
7. Murder During Discovery: Preserve the Scene
Fell’s seventh category reverses the timing assumption again. The victim is initially unconscious, not dead. The murderer joins those forcing entry and commits the killing amid the confusion. Everyone assumes the fatal act preceded discovery, although discovery provided the opportunity. For an investigator, this raises a different concern: what happens after the problem is reported?
Suppose a manager immediately “cleans up” the relevant records. Technology changes permissions. Finance corrects the supplier file. Each action may have a legitimate purpose, but investigators now face a changed environment. Do not mistake the condition you encounter for the condition that existed when the event occurred.
Contain ongoing harm, but document interventions and preserve pre-change evidence wherever possible. Identify who accessed relevant records after the allegation and what they changed. Helpful intent should not remove an action from the chronology.
Action: Include the response to discovery in the investigation, not merely the events preceding it.
What the CCO and Board Should Take Away
Carr’s categories suggest a discipline for compliance: separate the event from its explanation. Carry that discipline into your next program review, including a DOJ ECCP or COSO-based assessment. Select a closed investigation and ask whether its conclusion addressed the original assumptions, the evidence that challenged them, and the conditions that allowed the event.
For the CCO, the practical task is to connect findings to corrective action. Establish ownership, define what successful remediation means, and test whether the change addresses the demonstrated cause. For directors, move beyond asking whether the control existed. Ask management: What did the investigation establish about how the control actually operated, and what evidence supports the proposed fix?
Never close a locked-room compliance problem with the statement, “That could not have happened.” That statement belongs at the beginning of the investigation. In compliance, the locked door is not an explanation. It is an assumption to test.
