Training insights: New shoots – new courses on root cause analysis
It’s been nine years since the Chartered IIA started running an introductory course to root cause analysis (RCA) and the topic has moved on. Feedback after this course and in-house training events has prompted the institute to create two new training courses aimed at developing internal auditors’ understanding of, and skills with, RCA practices.
“Practical application of RCA techniques” is a one-day live virtual workshop which focuses on five popular RCA techniques – the Three-way Five Whys, the Fishbone diagram, the Bowtie technique, the Fault Tree and Causal Loop analysis. Attendees will learn what exactly these are, how they were intended to be used and their pros and cons.
In-depth demonstrations of three of the five RCA techniques will enable participants to practice RCA on real issues. This enables us to identify and address common mistakes, so participants are confident about undertaking RCA themselves and will be able to check colleagues’ RCA deductions.
We also examine the importance of pinning down a timeline, how to check for causation, rather than correlation, and how to work backwards to prove that proposed root causes are not just contributing or immediate causes. Topics that usually come to the fore as people develop an RCA mindset are the importance of being clear about risk appetite, the consequences of risk and control gaps (especially the difference between current and potential consequences), and a clearer understanding of the “human factors” involved, going beyond commonplace thinking around culture.
“Incorporating RCA into an audit methodology and work programmes” is also a one-day virtual workshop, but this focuses on the more immediate question of how RCA might feature in audit methodologies and work programmes, (which often need to be adjusted to ensure they address causal factors).
This course highlights how RCA needs to feature across a range of internal audit activities from planning and scoping to agreeing actions and discussing themes with management and the audit committee. After all, unless the scope of an assignment is set correctly it can miss causal factors “just over the borderline”.
When you understand root causes you can ask important questions about causal factors earlier in the assignment planning process. This includes considering working hypothesis areas where you could use data analytics or data mining to test whether there is a problem. For example, is there a correlation between the time available to do supplier vetting, and/or the skills and experience of those doing vetting and instances where there are shortcomings? The workshop will validate your current approach to developing hypotheses, but also provide a more solid foundation for knowing other sorts of hypotheses to consider.
Then we undertake a thematic analysis of why things go wrong. Common cause types such as people/culture, processes or systems do not explain why things went wrong. For example, if a person does something inappropriate, you need to consider why they behaved that way. If you say they did something because it’s what the culture permitted or expected, you must then ask “Why was the culture that way?”. If you say “Because of the tone at the top”, you are still left with the question “Why was the tone at the top like that?”
This is why we look at how to develop/improve thematic analysis categories for senior management and the audit committee/board, paying particular attention to what the internal audit team has found (eg, problems with access rights or problems with “Know your customer” requirements), and why these issues have been recurring (eg, unclear roles and accountabilities, gaps in robust and timely management information and/or challenges with resources and prioritisation).
Lastly, we discuss real-life problems that occur when cause types are too detailed or are not used in a balanced way (eg, if there are regular references to culture or people, neither of which explain why the problem happened).
What will participants gain?
Attendees should finish the course understanding that RCA provides a lot more value when it is incorporated into business as usual, rather than being seen as a bolt-on activity.
They will recognise that, contrary to the received wisdom that RCA slows down assignments, it can help to speed up assignments (eg, in line with a Lean Auditing approach).
And they will find out how robust RCA can help internal audit to upgrade its contribution to more forward-looking questions around governance, risk and compliance-improvement opportunities, including, for example, the need for first- and second-line monitoring to improve process maturity. This is why the new Global Standards link RCA and sharing best practices.
RCA enables internal auditors to understand and explain cultural and behavioural risks in a way that is far more rigorous than staff surveys or interviews (which is why a recent survey identified that half the internal audit teams working on culture use RCA as a key tool).
Last, but not least, it’s useful to build on, or validate, your own approach to RCA based on what works elsewhere – there is little point starting from scratch. Attending one of these courses will also provide a “jump start” on the requirements regarding RCA in the new Global Internal Audit Standards, so it makes sense to plan for at least one this year.
James C Paterson is the former CAE of AstraZeneca and has recently written the book: Beyond the Five Whys: Root Cause Analysis and Systems Thinking. He is also the author of Lean Auditing.
This article was published in May 2024.