What is a root cause analysis?

There are three basic types of causes to a problem: physical, human, and organizational. Most problems arise from complex systems that are made up of more than one cause. A range of approaches, tools, and techniques can be used to help identify the issues

Per the Chartered Institute of Internal Auditors, ‘a root cause is a factor that caused a non-conformance and should be permanently eliminated through process improvement. Root cause analysis is a collective term that describes a wide range of approaches, tools, and techniques used to uncover causes of problems’.

There are a wide range of industries that use root cause analysis, such as healthcare, manufacturing, transportation, construction, chemical, petroleum and power. It can also be used to assist in any situation where there is a gap between actual and desired performance, recurring errors or failures with specific processes and undesirable events reoccurring.

Root Cause Analysis Pertaining to Internal Audit

One of the top problems in almost all different business sectors which results in great costs would be poor organizational culture. Putting a focus on culture and behaviors within internal audit is important for the auditing profession. In particular, internal audit can help the board understand how the culture is embedded in the way that affects behaviors in their organization. Poor organization culture is not a root cause, but cultural issues are caused by a range of organization, process and behavioral factors.

Internal audit has a role in supporting the board and executives, adding value to the organization and raising the profile of the internal audit function. The internal audit team has an overview of the entire organization, and can identify potential themes and behaviors that influence decisions. When applying root cause analysis, internal audit reports are usually streamlined with higher impact recommendations that are more meaningful to management. This provides a better understanding for not only internal audit but also the users of the systems within the entity. Auditors must have the critical skills required and experience to perform such works, and undertake training for management to perform root cause analysis.

Benefits of Root Cause Analysis

  1. Internal audit can be seen to be adding value to the organization
  2. There is the potential for cost reduction
  3.  Providing a learning process for better understanding of relationships, causes and effect and solutions
  4. Provides a logical approach to problem solving using data that already exists
  5. Reduces risk
  6. Prevention of recurring failures
  7. Improved performance
  8. Leads to more robust systems
  9. Streamlining of audit reporting.

How and When Root Cause Analysis is Applicable

  • At what point in the audit process would you consider applying RCA?
    • Undertaking an audit that has been carried out previously with reoccurring issues
    • Investigating an incident or problem
    • Issues raised involving on-going problems that require attention to risks not being managed
    • One on one supervisory meetings of auditor and their team
    • Identifying recommendations linked to root causes
    • Reporting to audit committees on overall trend of findings from internal audit
  • How do you determine which situations apply RCA?

    • Where there has been a signification event
    • Repetitive errors
    • Poor performance
    • Areas with limited to no assurance given
  • Who should be involved in RCA?

    • Line management (first line of defense) or other functions (second line of defense) should carry out root cause as part of business and should always be considered
    • Internal audit can also add value through conducting interviews with management involved, facilitating a meeting between management and staff in the department, and using those meetings to consider the issues
  • Timing of RCA and how it is built in

    • Does not have to be a significant part of the audit and can sometimes replace other testing
    • Discussions need to be had with the audit manager going forward
  • Impact on Audit Reports

    • Discussions about RCA should happen before the draft report is released
    • Saves time on re-writing the report and likely reduces number of findings
  • Culture of the organization barrier to using RCA

    • Discuss subject with audit committee and get them to “buy-in”
    • Use RCA in departments more responsive to change and communicate results
  • 3rd-Party Buy-In of RCA

    • Discuss with delivery partners
    • Include RCA in audit manual and embed within your process
  • What model should we use?

    • Consider choice based on the assignment you are undertaking and discussions with head of internal audit
    • Can be appropriate to use combination of approaches

Potential Issues for Internal Audit to Investigate

Culture can sometimes prevent staff from getting to the true root cause:

  1. Concern with repercussions from RCA than interest in solving problems
  2. Transferring blame on external reasons
  3. Changes to risk appetite may be significant and therefore deemed the cheaper solution is the correct option
  4. Experience and confidence using RCA techniques

Root Cause Analysis Techniques

There are a wide range of tools and techniques that can be used for root cause analysis. The five ‘Why’s’ technique was originally developed in the 1930s by the Founder of Toyota Motor Corporation, Sakichi Toyoda. Through the Toyota production system did these techniques become popular.

Ishikawa Diagrams

Also known as fishbone, or cause and effect diagrams, this first basic concept was used in the 1920’s but unpopularized in the 1960’s through the use in quality management in the Kwasaki shipyards. This diagram was also used to develop the Mazda Miata car.

This takes you through a process of first describing the problem, then collecting and analyzing data. After, you must brainstorm ideas and then identify potential causes. This should enable you to make analysis and identify the root cause and possible solutions. To identify this ‘root cause’, ask a number of questions such as:

  • What happened/what has the problem?
  • Why did it happen?
  • How can it be put right to stop it happening again?

Failure Mode Effects Analysis (FME)

This was developed in the late 1940’s to study the problems of malfunctions in military systems, and then was more developed by aerospace and automotive industries.

This involves cross-functional teams with diverse knowledge about products, processes, service, and can identify the factors leading to a failure, and identifying the consequences and seriousness of each effect. For each failure mode, the potential root causes are determined. Detection is rated best from 1 to 10, where 1 is absolutely certain to detect and 10 means it is not certain to detect.

Fault Tree Analysis

This was developed in the 1960’s for the initial purpose of the US Air Force to use in the Minutemen system by Bell Telephone Laboratories. It was then used by Boeing and Aerospace in the 70’s, and Chemical, Robotic and Software industries in the 80’s and 90’s.

This is a top-down approach that helps identify potential causes of system failures before any such failures take place and take action to reduce said risk. It is a graphical model within a system, and the process is in five main steps:

  1. Define the undesired event to study
  2. Obtain an understanding of the system
  3. Construct the fault tree
  4. Evaluate the fault tree
  5. Control the hazards identified


  1. Identifying root causes during an audit adds significant value to the work undertaken by ensuring the right and most effective action is suggested
  2. Managers and employees gain a better understanding why the problems exist and allow them to input corrective measures.
  3. Repeating issues and common themes are signs root causes have not been addressed.
  4. Vital that management and second line functions be encouraged to carry out proper root cause analysis in key areas
  5. Internal audit team should up-skill approach to root cause analysis
  6. Care should be taken when thinking there is only one root cause for an audit issues (rare)
  7. Also be diligent to categorize root cause analysis