Root Cause Analysis – How Internal Audit Can Help

Errors or irregularities may be identified as part of the procedures performed by your internal audit team. One of the key ways an internal auditor can add value to your institution is to perform a root cause analysis on any identified errors or irregularities.

A root cause analysis is the process of identifying why an issue occurred (versus only identifying or reporting on the issue itself). An issue is considered a root cause if removal thereof from the problem fault sequence prevents the final undesirable event from recurring. Performing a root cause analysis has these benefits:

• Insights into root cause analysis make it potentially useful as a pre-emptive method
• Can be used to forecast or predict probable events before they occur
• Adds insight to improve the long-term effectiveness and efficiency of the business process
• Issue may have a higher probability of occurring without a root cause analysis

A core competency for delivering insights is the ability to identify the need for root cause analysis and, as appropriate, actually facilitate, review and/or conduct a root cause analysis. Internal audit—due to independence and objectivity—can be the ideal group to analyze issues and identify root causes. In circumstances where the root cause of an issue is a result of actions or inaction of management, it’s critical to use an objective party to investigate and report back to senior management.

The goal should be to identify the root cause and identify the solution to prevent recurrence at the lowest cost in the simplest way. Resources spent on root cause analysis should be commensurate with the impact of the issue or potential future issues and risks.

More complex issues may require a greater investment of resources and more rigorous analysis. It also may require an extended amount of time and effort. You may not have all the skill sets needed for the issue identified. Your chief audit executive (or similar position) should make the final call on which issues to perform root cause analyses and which personnel should conduct them.

In addition to complex issues, management may be hesitant to perform a root cause analysis. You should anticipate these potential barriers:

• Business management may be reluctant to support internal audit’s role in the root cause analysis.
• Business management may resist conducting a root cause analysis due to necessary time and resource commitment from their staff. Management may be focused on a short-term fix to immediately maintain compliance or return the business process or transaction to its correct state.
• Determining the true root cause may be difficult and subjective. In these circumstances, value provided by internal audit is the independent and objective evaluation and presentation of various data and analyses from which management may draw a conclusion on the most probable root cause.

Five practical steps to performing a root cause analysis:

1. Define the problem
   1. What do you see happening?
   2. What are the specific symptoms?
2. Collect data
   1. Proof a problem exists
   2. How long has the problem existed?
   3. What is the problem’s effect?
   4. Know all the details of the problem before you can look at the contributing factors
   5. Look at data from all perspectives (customers, insiders, etc.)
3. Identify possible causal factors
   1. What sequence of events led to the problem?
   2. What conditions allow the problem to occur?
   3. What other problems surround the occurrence of the central problem?
   4. Identify as many causal factors as possible
      1. Use tools:
         1. So what?
         2. Five whys
         3. Cause-and-effect diagrams
4. Identify the root cause(s)
   1. Use same tools in Step 3 to identify the causal factors
   2. Dig deeper
5. Recommend feasible solutions
   1. Get chief audit executive’s (or similar position) feedback and guidance
   2. Do not take ownership of implementation (management function)

Contact your BKD advisor for more information.