I work in IT security profession as an IT auditor working in a lead / mentor role for my team.
Sometimes, one may not have sufficient concrete evidence to come to a conclusion such as regarding whether fraud is present or not. However, with intuition derived from a combination of experience and training, one can often tell more likely than not whether an event is legitimate or suspicious / fraudulent.
For example, in a batch of similar items, one might have a significantly different date much earlier or later than peers in the same batch, or transaction amounts just might be too "round"
How can I develop the intuition of team members to pursue deeper investigations in these types of cases?