Root Cause Analysis

Uncategorized 2 Minutes

Issues can arise any time during a project and there may be any number of reasons why they occur. The objective of a root cause analysis is to identify the underlying problem that led to the issue occurring in the first place, so that actions can be taken to better resolve or mitigate the issue from happening again in the future. An important part of an internal auditor’s job it helping management identify issues, discover the root cause, and help provide recommendations for mitigation.

While there are many ways to go about performing a root cause analysis, I tend to gravitate to the Ishikawa diagram (otherwise known as the “fishbone diagram” or “cause and effect diagram”). I like this type of analysis because of the approach it takes when it is unknown what the cause for the issue is; it’s like structured brainstorming. First you identify the issue. Then you branch out to identify potential causes. Each potential cause is then traced back to find the root cause using the “5 Ways” technique (a technique that asks the question “why” until getting to the root of the issue. This generally takes five questions of why).

Among the internal auditors I have worked with over the year, I have not seen many who have actively used formal root cause analysis techniques to help identify root causes to issues noted throughout the audit. It seems many people have a general understanding of what a root cause is, but don’t seem to apply formal techniques. I, myself, have been performing “root cause analysis” for internal audit finding for eight years now and I was never really taught how to perform root cause analysis techniques, nor was I required to used such techniques. I find this interesting since the Institute of Internal Auditors (the IIA), similarly to the Project Management Institute (PMI), emphasize root cause analysis techniques. So, while I am familiar with these various techniques from an academic standpoint, I have not yet utilized them in my work.

When attempting to identify root causes, I find it extremely difficult. Many times, it is relatively easy to find a surface issue and correct it, but it doesn’t seem to really mitigate the issue from occur again in the future. Performing root cause analysis seems to take a lot of practice and skill, but by utilizing the techniques, you can be better equipped to identify the root of an issue so appropriate actions can be taken to mitigate the issue.

So, as a takeaway, even if performing formal root cause analysis techniques is not required in your job, I would still highly recommend utilizing these techniques as it provides guidance and a structured process that helps you to get to the underlining issue so you are not just glossing over the surface causes for the issue without really getting down to the “heart of the issue.”

 Until next time.

CPack

Unknown's avatar

Published by CPack

I have been working in the field of Internal Auditing since 2010. I am a Certified Internal Auditor (CIA) who has experience in performing Gaming Regulation compliance audits for Casinos, as well as Federal Acquisition Regulation (FAR) compliance audits for government contractors. Due to the advancements in technology and how technology is used in everyday business, I am currently pursuing more knowledge in Information Systems (IS) for the purpose of being able to perform internal IS audits and provide businesses with assurances that their systems are working accurately and in compliance with internal processes, procedures, and applicable regulations. Data analytics is another area I am interested in learning more about. To learn how to look at data and use various data analytic approaches to find the potential risk areas or weaknesses with a system that can be corrected. While traditional auditing approaches have worked okay in the past, businesses capture more data these days that internal auditors can view and assess risk at a 100% instead of at a sample basis and making educated guesses as to whether a problem is systematic or not. While studying more about IS, I am learning more about Project Management. While I see many similarities in project management techniques and the Internal Audit Standards, after having worked in the Internal Audit field for eight years, I notice that Internal Audit doesn’t quite follow all the project management techniques that they “should” and that could be contributing to Internal Audit not being as affective, or value add, to the company as they could like to be. This blog will take a look at some of the project management knowledge areas and techniques that Internal Auditors should use and how these techniques can improve their audits, the reception of their audit results, and provide “value-add” to the company stakeholders.

Published

Leave a comment