Root Cause Analysis - Determining the Cause is important, as later the Recommendation or

Action Plan should address the Cause. [Apply Practice Advisory 2320-2: Root Cause Analysis to audit
scenarios]

Please refer to the technique for root cause analysis as below:

(1) Use of the five whys.

The 5 Whys is a question-asking method used to explore the cause/effect relationships underlying a
particular problem. Ultimately, the goal of applying the 5 Whys method is to determine a root
cause of a defect or problem.

The real key is to encourage the trouble-shooter to avoid assumptions and logic traps and instead
to trace the chain of causality in direct increments from the effect through any layers of abstraction
to a root cause that still has some connection to the original problem.

In practice, once you identify the process that has failed or is absent, you will almost always find
the cause of the process failure to be related to people not doing their jobs, or not having clear
directions, or not having the right information, or not being monitored adequately.

(2) Develop fishbone diagrams using COSO.

In fishbone diagrams, causes are usually grouped into major categories to identify sources of
variation. The categories typically include:

 People: Anyone involved with the process

 Methods: How the process is performed and the specific requirements for doing it, such as
policies, procedures, rules, regulations and laws
 Machines: Any equipment, computers, tools etc. required to accomplish the job
 Materials: Raw materials, parts, pens, paper, etc. used to produce the final product
 Measurements: Data generated from the process that are used to evaluate its quality
 Environment: The conditions, such as location, time, temperature, and culture in which the
process operates

Other RCA Tools as below:

(3) Applying the 80-20 concept -- Pareto charts.

(4) Failure mode and effect analysis

(5) SIPOC Diagram (Suppliers, Inputs, Processes, Outputs, Customers)

(6) Critical to quality metrics

(7) Statistical Correlation

Reference link: https://chapters.theiia.org/nashville/Documents/Audit%20Reporting%20and%20RCA
%202014%2001.pdf
In nutshell, you'll usually find three basic types of causes:

1. Physical causes – Tangible, material items failed in some way (for example, a car's brakes stopped
working).
2. Human causes – People did something wrong, or did not do something that was needed. Human
causes typically lead to physical causes (for example, no one filled the brake fluid, which led to the
brakes failing).
3. Organizational causes – A system, process, or policy that people use to make decisions or do their
work is faulty (for example, no one person was responsible for vehicle maintenance, and everyone
assumed someone else had filled the brake fluid).
Risk & Implications (The Consequence, Effect or Impact)
Risk define as the possibility of an event occurring that will have an impact on the achievement of
objectives. Risk is measured in terms of impact and likelihood.

Answer the question, “So what?”

There are different levels of an Effect, determined by asking “So what?” For instance, if the payroll
process does not work as intended:

 Direct, one-time effect – Employees might not be paid on time

 Cumulative effect on process – Employees might become upset
 Cumulative effect on organization - Employees might leave the organization
 High-level, systemic effect – The organization might not be able to serve customers

Expressed in financial, operational, significance, or some other measure of significance.