Once, I had to fix a headlight. When I tested the light bulb, it was good. When I tested the wiring to the bulb, it was good. So what was the problem? Looking closely revealed that the light bulb base was chipped and the bulb had a bayonet mount. Thus, the bulb never made contact with the wire at the bottom of the socket. If it was a screw mount, the bulb would have screwed down a bit further, contact would have been made, and all would have been fine. If you do not know what a bayonet mount is, then that is part of my main point—details matter.
My headlight repair was a bit like software testing. The unit tests were fine, but the system test failed because of an interface problem. In IT infrastructure, problem determination is often 70 percent of the repair time—that is why the right troubleshooting method matters.
If this seems obvious to you, that is great. So here is the problem. When I teach public workshops or work with companies, I often hear, “Why were we blindsided by a problem that blew up into a mess?” When looking into why audit, compliance, control, security and risk management people all missed a serious problem, it is often because the evaluation approach was structurally blind to the risk that became a problem, because no one really understood the details of “how it works.”
For years, I have been teaching the 5+2 Step Cycle for managing risk, starting with Step 1: Evaluate the environment and enterprise capabilities—in other words, “how it works.” After trying many teaching approaches, some people still get it more easily than others. Why?
- Detail people often have an edge over “big picture” people. However, detail people often focus on the unit test rather than the system test.
- Technical people often have an edge over nontechnical people. However, technical people can be easily nudged outside of their expertise—especially in audit and professional services teams striving for high people utilization rates.
- Training in the 5+2 Step Cycle and the specific technical subject matter certainly helps, but there is some other secret of success.
Increasingly, it appears a secret of success is a fix it personality. These leaders have a passion for fixing computers, small gasoline engines, bikes, clothes washers, golf swing, cars or plumbing. These high-achieving professionals are root cause detectives who love asking “how does it work?” In a world of replacement instead of repair, this critical skill seems to be getting rarer.
To fix this problem, “how it works” exercises bring insight and fun to workshops. Now you know one of my secrets. You can try a simplified version in your ISACA chapter or workplace. Just ask people to share a story about how they discovered root cause and fixed it.
You can make a difference in your chapter, organization and career—be a fixer.
Principal Analyst & Advisor, ValueBridge Advisors, USA