Root Cause Analysis:

The Essential Ingredient

Las Vegas IIA Chapter
February 22, 2018
 Agenda
• Overview
 Concept
 Guidance
 Required Skills
 Level of Effort
 RCA Process
 Benefits
 Considerations
• Planning
 Information Gathering
• Fieldwork
 RCA Tools and Techniques
• Reporting
 5 C’s

Screen 2 of 65
OVERVIEW
Root Cause Analysis (RCA)
A root cause is the most reasonably identified basic causal factor or factors,
which, when corrected or removed, will prevent (or significantly reduce) the
recurrence of a situation, such as an error in performing a procedure. It is also
the earliest point where you can take action that will reduce the chance of the
incident happening.

RCA is an objective, structured approach employed to identify the most likely

underlying causes of a problem or undesired events within an organization.

Screen 4 of 65
IPPF Standards, Implementation Guide, and Additional Guidance

IIA guidance includes:

• Standard 2320 – Analysis and Evaluation
• Implementation Guide: Standard 2320 –
Analysis and Evaluation
Additional guidance includes:
• PCAOB Initiatives to Improve Audit Quality
– Root Cause Analysis, Audit Quality
Indicators, and Quality Control Standards

Screen 5 of 65
Required Auditor Skills for RCA

Collaboration Critical Thinking

Creative Problem
Solving

Communication
Business Acumen

Screen 6 of 65
 Level of Effort

The resources spent on RCA should

be commensurate with the impact
of the issue or potential future issues
and risks.

Screen 7 of 65
Steps for Performing RCA

04
02 Formulate and
implement
Identify the corrective actions
contributing to eliminate the
factors. root cause(s).

01 03

Define the Identify the root

problem. cause(s).

Screen 8 of 65
Steps for Performing RCA

Risk Assessment Root Cause Analysis

1. Objective 1. Problem

2. Risk(s) 2. Root Cause(s)

a) Identification a) Identification

b) Measurement b) Measurement

c) Prioritization c) Prioritization

3. Risk Response 3. Recommendation/Management Action Plan

Screen 9 of 65
Benefits of RCA
RCA benefits the organization by
identifying the underlying cause(s) of an
issue. This approach provides a long-
term perspective for the improvement
of business/control processes. Without
the performance of an effective RCA
and the appropriate remediation
activities, an issue may have a higher
probability to reoccur.

Screen 10 of 65
RCA Considerations
Prior to performing RCA, internal auditors should anticipate potential barriers
that could impede the effort and proactively develop an approach for handling
those circumstances.

Skill Sets Resistance From Time

Management Commitment

Independence Subjectivity

Screen 11 of 65
PLANNING
What Is a Process?
INPUT

A process is generally defined as a

series of steps or actions performed to
achieve a specific purpose. The TRANSFORMATION
components of a process, including a
control process are:
• Input
• Transformation
• Output

OUTPUT

Screen 13 of 65
Tool: SIPOC Diagram

A SIPOC diagram is a high-level

process map that provides a
Suppliers
systematic way to analyze and
describe the input and output Inputs
Process
relationships of process steps.
It provides a graphical representation
of the interrelationships of activities of
the suppliers and customers and
focuses on the interrelationship Outputs
Customers
between those activities.

Screen 14 of 65
Tool: SIPOC Diagram

Screen 15 of 65
 Steps for Creating a SIPOC Diagram
1 2 3 4 5
Identify the
List the key
In the process Brainstorm the customers that
outputs of each
Clarify the start column, map the key outputs and will receive the
step of the
and stop of the 5 to 7 major customers for outputs and list
process in the
process. process steps in each major in the
corresponding
sequence. process step. corresponding
row/column.
row/column.

Identify the Review the

Brainstorm the List the key suppliers that completed
key inputs and inputs for each provide the SIPOC to verify
Determine the
suppliers for key output in the inputs and list in all key
areas of focus.
each key output corresponding the components are
identified. row/column. corresponding completed/
row/column. addressed.
6 7 8 9 10
Screen 16 of 65
Tool: FMEA
Failure modes and effects analysis (FMEA) is a
systematic tool used to evaluate a process and
identify where or how it might fail, and to
assess the relative impact of the failure.
• Similar to a risk and control matrix in internal
auditing.
• Failure modes are any errors or defects in a
process design, especially those that affect
the intended function of the process, and can
be potential or actual.
• Effects analysis refers to studying the
consequences of those failures.

Screen 17 of 65
FMEA – Failure Prioritization

Failures are prioritized according to:

• How serious their consequences are
• How frequently they occur
• How easily they can be detected

Screen 18 of 65
 Example – FMEA Worksheet

2 5 8 9 10
Identify failure modes Identify causes of the Rate ability to Calculate RPN and Determine and
and their effects failure modes detect prioritize assess actions
and controls
Screen 19 of 65
Steps for Performing an FMEA
1. List the key process step.
2. Identify what could go wrong in that step (potential failure
mode).
3. Identify the possible consequence(s) (potential failure
effect).
4. Assign a severity rating.
5. Identify the potential cause of a failure mode.
6. Assign an occurrence rating.
7. Document the present controls in place that prevent failure
modes from occurring or detect the failure before it reaches
the customer of the process.
8. Assign a detection rating.
9. Calculate the risk priority number (RPN).
10.Recommended actions are planned to lower high-RPN
(high risk) process steps.
Screen 20 of 65
Severity Rating
Description of Severity Recovery

Severity Reputational Impact on

Score
Rating Organizational & Stakeholders (i.e., What Would it Take
EBIT Duration Impact on Value
Operational Scope customers, shareholders, to Recover?
employees)

Enterprise-wide;
Complete loss of
Catastrophic Complete inability to
9/10 > $200M Irrecoverable confidence in all 3 Collapse of market Acquisition or
business operations
groups.
enterprise.

2 or more divisions;
2 or more changes
Recoverable Significant, ongoing > 50% reduction in
Sustained losses in 2 or senior leadership,
7/8 Critical < Long Term interruptions to capitalization, accessing
stakeholder groups. restructuring,
24-36 operations within 2 or $2 billion liquidity reserve.
changes to strategic
divisions

>25% reduction in market 1 or more changes

Recoverable 1 or more division(s); capitalization, senior leadership,
Moderate loss in 1 or more
4/5/6 High < Short Term Moderate impact within minimal operating cash significant changes
stakeholder groups.
12-24 more division(s). maintenance of $2 billion operating plans and
reserve. execution.

Temporary Refinements or
1 division; Limited to minor/short-
2/3 Moderate < $50M less than 12 Miss forecast(s) and/or adjustments to
Limited impact within 1 1 stakeholder group.
months) plans and

1 Minimal < $20M Minimal Impact

Occurrence Rating
Score Occurrence Rating Percentage

9/10 Very high (failure is almost inevitable) > 90%

7/8 High (repeated failures) < 90%

4/5/6 Moderate (occasional failures) < 60%

2/3 Low (relatively few failures) < 30%

1 No known occurrences on similar processes < 10%

Detection Rating
Score Detection Rating Description

Controls are non-existent or have major deficiencies and

9/10 Failure will be passed onto customer
intended

7/8 Low Limited controls in place, high level of risk remains

4/5/6 Moderate Key controls in place, with significant opportunities for

Controls properly designed and operating, with opportunities

2/3 High
identified

1 Certain – Failure will be caught by control Controls properly designed and operating as intended
FIELDWORK
RCA Fieldwork Tools and Techniques
Simple techniques such as inquiry and observation are useful for
determining the root cause in many of the issues to be analyzed.
More elaborate RCA tools and techniques should be reserved for situations
where the benefit outweighs the cost.
Examples of these types of tools and techniques include:
• The 5 Whys
• Fishbone diagram
• Fault tree analysis
• Pareto chart
• Scatter diagram
• Cause and Effect Matrix
• Business Process RCA
Screen 25 of 65
Tool: The 5 Whys
• The 5 Whys is a questions-asking technique used
to explore the cause/effect relationships
underlying a particular problem, with the goal of
determining a root cause of a defect or problem.
• By repeating why five times, the nature of the
problem as well as its solution usually becomes
clear.
• Ask "why" and identify the causes associated with
each sequential step towards the defined problem
or event.
• "Why" is taken to mean "What were the factors
that directly resulted in the effect?"

Screen 26 of 65
The 5 Whys – Questions-Asking Method
The following examples demonstrates the basic process of
the 5 Whys:
• The vehicle will not start. (the problem)
The alternator The vehicle was
belt was well not maintained
The battery is The alternator is The alternator
beyond its useful according to the
dead. not functioning. belt has broken.
service life and recommended
(first why) (second why) (third why)
not replaced. service schedule.
(fourth why) (a root cause)

• The worker fell. (the problem)

By the fifth “why,”
Changes in the internal auditor
There was oil on The part keeps
A broken part. procurement should have
the floor. failing.
(second why) practices. identified or be
(first why) (third why)
(fourth why) close to identifying
the root cause.

Screen 27 of 65
The 5 Whys Analysis – Jefferson Memorial Example
Problem: The stones of the Jefferson Memorial are eroding!
• Why are they eroding?
o The frequent washing of the stone.

• Why are the stones washed so often?

o There are so many bird droppings on the stones.

• Why are there so many bird droppings?

o A large number of birds come around to eat the abundant food
supply of little black spiders.

• Why are there so many little black spiders?

o To eat the millions of little midges around the memorial.

• Why are there so many midges?

o At dusk they turn on the lights at the memorial. Midges are attracted
to the light and dusk is their optimum time to mate.

Solution: Turned on the lights one hour later and the midges
disappeared.

Screen 28 of 65
The 5 Whys – Techniques
5 Whys Table
There are two primary
techniques used to Team: ABC Internal Audit Department Date: February 1, 2017

perform the 5 Whys Issue: The stones of the Jefferson Memorial are eroding.
analysis: Proximate Intermediate Root Proposed

• The 5 Whys can be used

Cause Causes Cause Solution

effectively in conjunction 1. Why? 2. Why? 3. Why? 4. Why? 5. Why?

with the fishbone
Why are they Why are the Why are there Why are there so
diagram and fault tree eroding? stones washed so so many bird many little black Why are there so
analysis tools often? droppings? spiders? many midges?

• A hierarchical table 1. Reason 2. Reason 3. Reason 4. Reason

format – Comprised of
creating a table in either The frequent There are so A large number To eat the millions At dusk they turn Turn on the lights
washing of the many bird of birds come of little midges on the lights at the one hour later and
a Word document or an stone. droppings on the around to eat around the memorial. Midges the midges will
stones. the abundant memorial. are attracted to disappear.
Excel spreadsheet food supply of the light and dusk
little black is their optimum
spiders. time to mate.

Screen 29 of 65
Challenges with The 5 Whys Technique

• Solely using the 5 Whys approach can lead to

a very linear thought process, where the
auditor mistakenly assumes there is only one
true root cause to an issue, and that if
successful in finding that root cause, the
problem will be permanently solved
o Multiple Root Causes
o Solving the Problem Completely

Screen 30 of 65
 Tool: Fishbone Diagram
• Fishbone diagrams are causal diagrams that help you visually display the many
potential causes for a problem or an effect.
• When utilizing a team approach to problem solving, there are often many
opinions as to the problem’s root causes. The fishbone diagram facilitates
capturing these different ideas and stimulating the team’s brainstorming on
root causes.

Screen 31 of 65
Steps for Creating a Fishbone Diagram
1. Start with stating the problem.
2. Brainstorm the major categories of causes of the
problem.
3. Write the categories of causes as branches from
the main arrow.
4. Once you have the branches labeled, begin
brainstorming possible causes and attach them to
the appropriate branches.
5. Write sub–causes branching off the causes.
6. When the group runs out of ideas, focus attention
to places on the chart where ideas are few.
7. Finalize the fishbone diagram by reviewing and
getting consensus on the true root cause(s) of the
problem.

Screen 32 of 65
Fishbone Diagram – Usage Tips
Tips for using fishbone diagrams include:
• State causes, not solutions
• Show relationship between causes
• Test the causal relationships by starting
from the smallest bone and connecting
each potential cause with the words “might
cause”
• Take note of causes that appear repeatedly
• Review each major cause category
• Circle the most likely causes on the
diagram.

Screen 33 of 65
Fishbone Diagram – Root Cause Summary Table
The results of the fishbone diagram exercise can be summarized in a root cause
summary table capturing each root cause noted by category and inserting the
corresponding management action plan alongside.
Issue: XXX Date: XXX
Causal factor # 1 Category Management Action Plan
Description:
XXXX Man  XXX
 XXX
 XXX
Causal factor # 2 Category Management Action Plan
Description:
XXXX Machines  XXX
 XXX
 XXX
Causal factor # 3 Category Management Action Plan
Description:
XXXX Methods  XXX
 XXX
 XXX
Causal factor # 4 Category Management Action Plan
Description:
XXXX Measurement  XXX
 XXX
 XXX

Screen 34 of 65
Tool: Fault Tree Analysis
Cash account doesn’t
reconcile
Failure Event

Shortage in cash First level cause

account

OR

Accounting
Second level
Bank error Fraud causes
error

OR

Skimming Embezzlement Third level causes

AND

Opportunity Rationalization Pressure Fourth level

causes

Cash accountant
Cash accountant not Cash accountant passed purchased expensive car
required to take vacation over for promotion in anticipation of Fifth level causes
promotion

Screen 35 of 65
Steps for Performing a Fault Tree Analysis
1. Begin constructing the Fault Tree by stating the
problem/issue/undesired event, placing it in the first box, and
labeling it the Failure Event.
2. The audit team brainstorms the immediate causes of the
problem/issue/undesired event and determines whether an
OR gate or AND gate should be applied.
3. Evidence is gathered by the audit team to confirm the paths
to follow for OR gates and continue to build out the tree,
along with AND gate paths as well.
4. The above process continues down through each level until
all relevant causes are identified the root cause(s) are
reached.
5. The audit team evaluates the Fault Tree and develops action
plans corresponding to the root cause(s) determined.

Screen 36 of 65
Root Cause Measurement/Prioritization (Data Analytics)
• While traditional internal audit
methodologies have served the
profession well for decades, those
methodologies are now being updated
and refined to incorporate data analytics
in order to successfully leverage its
potential.
• Data analytics are being are embedded
into every single stage of the audit
lifecycle, i.e., risk assessment, planning,
fieldwork, and reporting. Additionally, the
use of data analytics techniques are being
considered core to many Internal Audit
departments’ strategy and vision.
Screen 37 of 65
Tool: Pareto Chart
The Pareto Chart illustrates the Pareto principle, frequently referred to as “The 80/20
Rule,” which holds that 20 percent of the population accounts for 80 percent of the
situation. The purpose of the Pareto chart is to highlight the most important set of
factors or activities that most contribute to a problem or opportunity.

Screen 38 of 65
 Pareto Chart
A Pareto Chart can be a useful measurement tool for the audit team in an RCA effort. It
can focus their attention in the direction of the most important cause or causes to resolve
in order to reduce or eliminate the problem. This is particularly helpful when the team is:

• Analyzing data about

potential root causes or the
frequency of problems.
• Dealing with many different
problems and causes but
wants to focus on the most
significant ones.
• Analyzing wide-reaching
causes by zeroing in on
their individual components

Screen 39 of 65
Steps for Creating a Pareto Chart
1. Choose the problem and causes that will be compared/rank-ordered by
brainstorming, using a fishbone diagram.
2. Choose the time period for the analysis.
3. Collect the data.
4. Decide on appropriate measurement for your data, e.g., frequency, quantity, cost, time,
etc.
5. Devise an appropriate scale for your measurements.
6. Decide on the categories that will be used to group your data items.
7. Create a bar for each category and add appropriate labels for each, placing the tallest on
the far left, descending to the smallest on the far right.
8. Calculate the subtotal of each category’s measurements.
9. Beginning at the top of the first category bar, draw a line showing the cumulative
percentage total reached with the addition of each cause category.
10. Draw a line at 80% on the y-axis running parallel to the x-axis. Then drop the line at the
point of intersection with the curve on the x-axis. This point on the x-axis separates the
important causes on the left from the less important causes on the right.
Screen 40 of 65
Tool: Scatter Diagram

A scatter diagram is a type of diagram that displays pairs of data, with one
variable on each axis, to look for a relationship between them.

Screen 41 of 65
Tool: Scatter Diagram

Screen 42 of 65
Tool: Scatter Diagram

Screen 43 of 65
Steps for Creating a Scatter Diagram
1. Brainstorm potential causes and effects for the problem using a
fishbone diagram.
2. Identify all potential pairs of cause and effect variables associated
with the problem.
3. Use existing data or collect new data regarding to what extent
causes contribute to the problem.
4. Select the most likely pairs of cause and effect variables to verify.
5. Draw a graph with the independent variable on the horizontal axis
and the dependent variable on the vertical axis.
6. Select the scales for the x and y axes.
7. Plot the data by putting a dot for each pair of data where the x-axis
value intersects the y-axis value.
8. Determine if there is a relationship between the cause and effect,
noting whether the points clearly form a line or a curve.

Screen 44 of 65
Cause and Effect Matrix

Screen 45 of 65
Steps for Creating a Cause and Effect Matrix

1. List the outputs along the top section of

the matrix.
2. Rank each output numerically using an
arbitrary scale.
3. Identify all potential inputs or causes that
can impact the various outputs and list
these along the left hand side of the matrix.
4. Numerically rate the effect of each input on
each output within the body of the matrix.
5. Use the totals column to analyze and
prioritize where to focus your efforts

Screen 46 of 65
Business Process RCA

Key to business process RCA is to identify the

following:
• Cost and time drivers
o Reduce frequency of occurrences
o Reduce cost and time of each
occurrence.
• Bottlenecks and resolve

Screen 47 of 65
REPORTING
The 5 Cs

Here’s a mnemonic device for remembering the

components of audit observations:
• Condition (what is)
• Criteria (what should be)
• Cause (why)
• Consequence [Effect] (so what)
• Corrective action plans and recommendations
(what is to be done)

Screen 49 of 65
A Medical Analogy
The five Medical Term Example Analogous Internal Audit Term

components of Healthy State  Absence of a cough Criteria

 Temperature of 98.6° F
audit observations  Clear lung sounds
are analogous to Symptom  Cough Condition
the components  Fever
 Rattling in the lungs
that medical
Diagnosis  Common cold Cause
doctors use.  Pneumonia
 Lung cancer

Prognosis  Feel sick for a week Effect

 Be seriously ill for several weeks
with possible long-term
consequences
 Deteriorate and die

Treatment  Drink fluids and rest Recommendations and Action Plans

 Receive antibiotics
 Receive cancer therapy

Screen 50 of 65
Condition

Condition is the factual evidence that the internal auditor found in the course
of the examination (the current state). The condition answers the question:
“What is?”
When documenting the condition, ensure the following is included:
• When (i.e., how often)
• Who
• What
• Why

Screen 51 of 65
Criteria

The standards, measures, or expectations used in making an evaluation and/or

verification (the correct state). The criteria answers the question: “What should
be?”

Screen 52 of 65
Types of Criteria
• Policies and procedures
• Industry standards
• Regulations and laws
• Others
o Comparable operations
o KPIs
o Best or leading practices
o Mission, vision, and strategy
o Business plan
o Goals or targets
o Customer surveys
o Competition
o Benchmarking studies

Screen 53 of 65
Cause

Cause is the reason for the difference between the expected and actual
conditions. The cause answers the question: “Why?”

Screen 54 of 65
 Identify Causes

• Ask “Why do the conditions exist?”

• Identify proximate, intermediate, and root
levels of cause.
• Identify which level of cause is actionable.

Screen 55 of 65
Levels of Cause

• Proximate cause(s) – The action(s) or lack of

action(s) that led directly to the condition
• Intermediate cause(s) – The cause(s) (linear
or branched) that led to the proximate
cause(s); may be the actionable cause(s)
• Root cause – The underlying cause and may
be the actionable cause.

Screen 56 of 65
Levels of Effect

When you repeatedly ask “so what,” you

move through a series of effects:
• Direct, one-time effect on the process
• Cumulative effect on the process
• Cumulative effect on the organization
• High-level, systemic effect

Screen 57 of 65
Corrective Action Plans and Recommendations
Guidance
Communications must include the engagement’s
objectives and scope as well as applicable
conclusions, recommendations, and action
plans. “What is to be done?”
Matching and Linking Root Causes
• Recommendation must address underlying root
cause(s) and resolve both the Condition and the Cause
• Goal is preventing problem recurrence
Multiple Root Causes
• There may be more than one root cause for an event or
a problem
• Focusing on a single cause can limit the solutions set

Screen 58 of 65
 Types of Corrective Action Plans and Recommendations

• Condition-based
• Cause-based
• Recovery-focused

Screen 59 of 65
Tying RCA Audit Findings to Planning Documentation

Condition: Customer does not receive order

Criteria:

Cause: Failure on part of package delivery service

Effect: Loss of future sales

Recommendation: Research package delivery success rate before selecting delivery service

Screen 60 of 65
Summary

• Condition

• Criteria

• Cause

• Effect

• Recommendations/Management Action Plans

Screen 61 of 65
Recap
• Overview
• Planning
 Information Gathering
• Fieldwork
 RCA Tools and Techniques
• Reporting
 5 C’s

Screen 62 of 65
Action Plan

Screen 63 of 65
Questions and Answers

Screen 64 of 65
Thank You!

Screen 65 of 65