RELEVANCE EXCELLENCE RESULTS

Root Cause Analysis

Sesi 1 - Overview
AGENDA (session -1)

A. Understanding Root Cause Analysis (RCA)

B. Objective of RCA
C. RCA in Standard (IPPF) and Best Practice
D. Required Skill to do RCA
E. Cost and Benefit of doing RCA
A. Understanding the Root
Cause Analysis (RCA)
Definition

Definition of Internal Auditing

Internal Auditing is an independent, objective assurance and

consulting activity designed to add value and improve an
organization's operations. It helps an organization accomplish
its objectives by bringing a systematic, disciplined approach
to evaluate and improve the effectiveness of risk
management, control, and governance processes. (IPPF)
Why do we need the RCA?
Feedback from stakeholders:
many audit findings are not adding
value
core issues are not being addressed
Audit Finding Attributes

Condition : Actual / fact

Criteria : References, should have a sufficient of control,
clear target

Cause : should be iditifiable, manageable / controlable

Consequences (Effect) : Could be in form of loses, not

meet the target, obtain the negative impact

Recommendation (suggestion) : PIC, Action Plan, Do able,

reducing impact, removing cause
 Case : Audit Finding – “Kecelakaan di Sekolah”
Seorang pelajar sekolah dasar (SD) terpeleset saat bermain di sekolah dan menderita luka. Setelah
diamati ternyata pelajar tersebut tidak sengaja menginjak kulit pisang yang di buang ke lantai. Apa
saran anda ketika mengamati kejadian ini ?

Condition : Terjadi kecelakaan di tempat bermain sekolah dasar (SD)

Criteria : Tempat bermain seharusnya aman
Cause : Pelajar menginjak kulit pisang
Consequence : Pelajar Terluka

Kemungkinan bentuk Recommendation (agar tidak terjadi kecelakaan)

(a). Untuk selanjutnya, kepada setiap orang dilarang Makan Pisang di tempat bermain
(b). Untuk selanjutnya, kepada setiap pelajar dilarang bermain di sekolah
(c). Untuk selanjutnya, kepada setaip orang untuk membuang kulit pisang di tempat sampah
(d). Untuk selanjutnya, kepada setiap orang diminta untuk membuans sampah pada tempatnya
(e). …………….
Definitions of RCA
Root Cause
Deepest underlying cause(s) of positive or negative symptoms within any
process that, if resolved, would eliminate or substantially reduce the
symptom.
The factor that, when you fix it, the problem goes away and doesn’t
come back
Root Cause Analysis (RCA)
a tool used both reactively, to investigate an adverse event that already
has occurred, and proactively, to analyze and improve processes and
systems before they break down
is a collective term that describes a wide range of approaches, tools,
and techniques used to uncover causes of problems.
Symptoms
the noticeable gap between expectations and reality; the “red flag” that
draws attention to the issue.
Root Cause Analysis:
a powerful tool for internal auditor
What is RCA ?

Surface view
(symptoms)

Below the Surface

(root)
Symptom vs Root Cause Approach
B. Objectives of doing RCA
PA 2410-1 criteria for communicating
Reporting is Mandatory
Observations and recommendations are
based on the following attributes:
- Criteria
- Condition
- Cause
- Effect (consequence)

Not in IG - 2410
5C - Attributes

Criteria: The law, regulation, contractual obligation, policy,

procedure, or best practice that is expected to be followed
Condition: The factual analysis of the process as it exists
Consequence/Effect: Why the issue is important and
noteworthy from a compliance, financial, or operational
standpoint
Cause: The root cause which allowed the condition to not
emulate the criteria
Corrective Action/Recommendation: Change that will address
the root cause, allow the current condition to mirror best
practice or other criteria and does not cost more in relation to
its effect
Lack of Audit Finding

Auditors attacks the symptom (issues)

not the root cause.
Auditors have a lack of competencies in
identifying The root cause.

Need the knowledge of RCA

General Steps of RCA

1. Define the Problem (Based on Data)

2. Identify Possible Causal Factors
(Contributing Factors)
3. Identify Root Cause
4. Formulate Corrective Action.
(Recommend and Implement Solution)
C. RCA in Internal Audit:
Standards and Best
Practices
IPPF Consideration
2410.A1 – Final communication of engagement results must
include applicable conclusions, as well as applicable
recommendations and/or action plans. Where appropriate, the
internal auditors’ opinion should be provided. An opinion must
take into account the expectations of senior management, the
board, and other stakeholders and must be supported by
sufficient, reliable, relevant, and useful information.

2410.A2 – Internal auditors are encouraged to acknowledge

satisfactory performance in engagement communications
IPPF Consideration
IG 2320 : Analysis and Evaluation
Internal auditors often conduct a root cause analysis to identify the
underlying reason for the occurrence of an error, problem, missed
opportunity, or instance of noncompliance. Root cause analyses enable
internal auditors to add insights that improve the effectiveness and
efficiency of the organization’s governance, risk management, and control
processes. However, these analyses also sometimes require extensive
resources, such as time and subject matter expertise. Thus, when
conducting a root cause analysis, internal auditors must exercise due
professional care by considering effort in relation to the potential benefits
(Standard 1220.A1).
Although complex issues may require more rigorous analyses, in certain
circumstances a root cause analysis may be as simple as asking a series
of “why” questions in an attempt to identify the root cause of a variance.
Role of Internal Audit
Internal Audit is independent institution in
company : objective, not bias, based on
data or evidence
Internal Audit has a wider horizon than
others.
D. Required Skill to do the RCA
Implementing RCA in complicated Issues

RCA requires more resources

Root cause analysis may require an extended amount of
time to analyze the process, personnel, technology, and data
necessary to identify and support the assessment of a root
cause.
RCA requires the expert
Auditors may not have all the skill sets necessary to conduct
the specific root cause analysis under consideration. Chief
audit executives (CAEs) should validate that the experience
and expertise of their staff are sufficient.
RCA requires a commitment
When the anticipated time commitment or necessary skill
levels exceed that available within the internal audit activity,
the CAE should make recommendations for management to
conduct a root cause analysis.
Required skill (in General)
RCA is Wide Range Knowledge & Skill

Understanding Collaboration
Business Process
Data Analytics
Potential Barriers
Business management may be reluctant to support internal audit’s role
in root cause analysis.
Business management may resist conducting a root cause analysis
due to the necessary time and resource commitment from their staff.
Management may be focused on a short-term fix to immediately
maintain compliance or return the business process or transaction to
its corrected state.
Long-term fixes are addressed by management only as time and
resources allow.
Determining true root cause may be difficult and subjective — even
when significant quantitative and qualitative data is available.
Perception Risk
Auditor could be perceived to take over the role of
management
How the Auditor manage the risk
 Objective Analysis.
 Auditor gives recommendation not the order
 Management responsible to execute the recommendation
 Role of Auditor has to be stipulated on Audit Charter
The Managerial Issues in RCA
The following issues is common in implementing the RCA :
 Competence of personnel
 Hiring qualified personnel
 Lack of or insufficient training
 Adequacy of technology or tools
 Appropriateness of organization or departmental culture
 Health of organization or departmental morale
 Level or number of resources (i.e., budget or personnel)
 Process circumstances and other influencing items that led the
person or persons to make the decisions
 Decision-making authority of the person or persons involved
Deeper RCA
Root cause analysis that stops at the identification of
physical and process components as the root cause (e.g.,
technology systems, policies, components, training) may
not be complete.
A true root cause analysis will seek to understand why
good people make bad or inadequate decisions.
In these cases, auditors are searching for situational
awareness and trying to understand all the
circumstances.
E. Cost and Benefit
The Benefit of RCA
RCA presents a break through and long term perspective solution.
RCA ensure there is no repetitive issues (problem).
RCA could be very simple and not costly
RCA could be implemented in several area, such as :
 a surprise risk event,
 process failure,
 asset damage or loss,
 production stoppage,
 safety incident,
 quality degradation, or
 customer dissatisfaction.
The Cost of RCA

Time Consuming.
Need the expert team
Need Management Commitment
Need Further Consideration, whether
 Impact of RCA to improvement (Valuable)
 Critical Issues (Important)
 Long term Impact (sustainability)

.
 “Leadership is not about titles,
positions, or flow charts. It is about
one life influencing another.”
John C. Maxwell
RELEVANCE EXCELLENCE RESULTS

Root Cause Analysis

Sesi 2 - Planning
AGENDA (session -2)

A. The Engagement (1) - Planning

B. Selection Method
C. Failure Analysis
D. SIPOC

Dr. Dipa Mulia, MM., MH.

Contact : dipa.mulia@yahoo.com
The Engagement (1)
Objective : set up result, set up criteria
Scope : must be sufficient to achieve objective
Planning
Resource Allocation : must be sufficient
Work Program : Procedure of Audit to achieve the objective

Identifying Information : sufficient, reliable, relevant, useful

Analysis & Evaluation : Appropriate analysis & evaluation
Documenting Information : access, retain and custody
Supervision : to assure the quality
Performing

Criteria : must include objective, scope and result

Quality : accurate, objective, clear, concise, construct,
complete and timely manner
Communicating Communicate Result : communicate to appropriate parties
Planning : Objectives
Objective : set up result /set up criteria
Planning Scope : must be sufficient to achieve objective
Resource Allocation : must be sufficient
Work Program : Procedure of Audit to achieve the
objective

Objective : Minimizing Gap between Factual and Expected

Source of Factual Source of Expected

Observation GAP Vision

Measurement Mission
Analytics Target (SMART criteria)
Planning : Scope & Resources

The scope of the engagement must include consideration of

relevant systems, records, personnel, and physical properties,
including those under the control of third parties.

Internal auditors must determine appropriate and sufficient

resources
Appropriate refers to the mix of knowledge, skills, and other
competencies needed to perform the engagement.
Sufficient refers to the quantity of resources needed to
accomplish the engagement with due professional care.
Planning : Work Program

Work programs must include the procedures for identifying,

analyzing, evaluating, and documenting information during the
engagement.

Audit Engagement Design

1. Objectives
2. Scope of Audit
3. Methodology :
a. Analytical Tools
b. Data / information needed
c. Data Acquisition Design
d. Data Analysis Procedure
 List of Problem

1. Banyak karyawan yang datang terlambat ke kantor (tidak disiplin)

2. Terdapat piutang kepada pihak ketiga yang jatuh tempo tetapi belum
terbayar
3. Terdapat kewajiban kepada pihak ketiga yang sudah jatuh tempo
yang belum dibayarkan
4. Terdapat pengiriman yang tidak tepat waktu
5. Terdapat pengiriman yang tidak sesuai alamat penerima nya
6. Terdapat keterlambatan penerbitan polis asuransi
7. Terdapat kesalahan pengukuran oleh peutugas
8. Terdapat ketidaksesuaian antara rencana biaya dan realisasi
If everything is important,
nothing is important.
Brian Mulroney
Selection Methods
Company "X"

9
8 Priority

High
7
6
Case
Frequency

Impact
5
4
3
2

Low
1
0
A B C D E F G
Case
Low High
Likelyhood
Performance
High

1. Rate of Occurrence
2. Importance and Performance
Priority Matrix
3. Risk Assessment
Low

Case

Low High
Important
Tools to identify problem
• Histogram. Visual diagram that helps
identify patterns or anomalies. (such as :
rate of occurrence)
• Pareto chart. Visual tool used to illustrate
which causes generate the most effects.
• Scatter chart. Used to illustrate
relationships between two causes or
other variables in the problem situation.
• Problem concentration diagram. A
visual chart that maps the layout or
Data
structure of a site or system and is used Analytics
to identify where problems occur.
• Relations diagram. A tool used to
identify logical relationships between
different ideas or issues in a complex or
confusing situation.
• Affinity diagram. A chart that helps
correlate seemingly unrelated ideas,
causes, or other concepts so they might
collectively be explored further.
(source : Andersen & Fagerhaug)
Tools to identify root cause
• Cause-and-effect chart. An easily
applied tool used to analyze possible
causes of a problem. (such as : Ishikawa)
• Matrix diagram. A visual technique for
spotting relationships between factors
and analyzing causal relationships
between them. The diagram can thus be
used to determine which of different Common
possible causes contribute the most to a tools for
problem. RCA
• Five whys. An approach used to delve
ever more deeply into causal
relationships.
• Fault tree analysis. A tool for looking
forward and anticipating what problems
can occur in a system, product, or
business process.

(source : Andersen & Fagerhaug)

Case : Asuransi asset Perusahaan
Pengisisian Form

Pengajuan ke pihak Asuransi

Verifikasi Pihak Asuransi

Pembayaran Polis

Terbit Polis untuk 1 tahun

Perpanjangan Polis
C : Failure Analysis
Failure Mode and Effect Analysis (FMEA)
Potential Severeity Cause of Occurance Present Detection Risk
Key Process Failure Effect
Failure Mode Rate Failure Rate Control Rate Priority
Pengisisian Form tidak Form templete
Stop proses 5 8 2 80
Form lengkap Rumit Form

Pengajuan ke Dokumen Dokumen

Dikembalikan 5 7 Check List 2 70
pihak Asuransi salah banyak

Verifikasi Pihak kurang Daily

Tidak diproses terlambat 5 8 1 40
Asuransi monitor Contact

Pembayaran Petugas belum polis tidak transaksi

5 5 reminder 3 75
Polis bayar keluar banyak
Terbit Polis Polis tidak polis tdk kurang
5 4 remider 3 60
untuk 1 tahun diambil tersedia kurir
Perpanjangan tidak polis transaksi
5 8 remider 4 160
Polis mengajukan kadaluarsa banyak
D : SIPOC

Supplier Input Process Output Customer

Tim Marketing Data Nasabah Pengisisian Form Form Lengkap Administrasi Kredit

Pengajuan ke pihak
Adminsitrasi Kredit Form Lengkap Form Pengajuan Marketing Asuransi
Asuransi

Form Verifikasi Pihak

Marketing Asuransi Persetujuan Bag. Penagihan
Pengajuan Asuransi

Bukti
Pihak Asuransi Invoice - in Pembayaran Polis Perusahaan Asuransi
Pembayaran
Bukti Terbit Polis untuk 1 Polis untuk 1
Pihak Asuransi Admintrasi Kredit
Pembayaran tahun Tahun
Pengajuan
Adminitrasi Kredit Perpanjangan Polis Polis Baru Bag. Penagihan
Perpanjangan