THE BIG QUESTION: How Can You Simplify Root Cause Analysis When Many Complex Variables Are Involved?
Root cause analysis requires Internal Auditors to develop critical thinking skills. Ideally, their managers provide structure, tools, and guidance to help them along.
Most Internal Auditors know the Five Whys technique for root cause analysis. With that technique, you ask “why” something happened until you reach a fixable cause. It can work well for issues with one or a few clear-cut root causes.
The problem is, many issues have multiple connected and interdependent contributing factors — making it more challenging to reach the right root causes.
THE BIG TAKEAWAY: A strong analysis drives strong, actionable recommendations. As risks grow more complex, Internal Auditors must sharpen their critical thinking skills and collaborate across functions to develop recommendations capable of catalyzing real change.
THE MISSION: Fix the Whole Problem the First Time
Pat explained, “You can identify recommendations, but they might not be the ones that address each of the issues. We want to fix the whole problem the first time. You may fix one thing. Maybe it moves the needle a little. But to really add value, we’ve got to spend more time — so we can really help drive organizational change.”
That’s why Pat uses the fishbone analysis technique to help his team really dig in. When you get it right, he says, “Your recommendations are going to tie almost one-to-one to the root causes.”
THE FRAMEWORK: The Fishbone Diagram for Root Cause Analysis
Fishbone diagrams — aka Ishikawa diagrams — are, as Pat articulated, “a visual way of organizing possible causes into logical categories. Instead of following a single chain of whys, this tool is designed for situations where there are likely multiple contributing factors at play.”
Step 1: Identify the Problem Statement
Clearly define the problem that needs solving. Pat recommends talking through:
- Audit Area/Engagement: Specify the process, system, or function being audited.
- Criteria (Expected): Cite the policy, standard, or control that defines correct performance.
- Condition (Observed): Concisely describe the deviation or deficiency supported by audit evidence.
- Problem Statement: Re-state the condition as a clear problem, placing it at the head of the fish.
Step 2: Gather a Cross-Functional Team
Identify and bring together the right stakeholders (e.g., process/control owners, SMEs). Ask if there’s anyone else you should bring into the discussion.
Cross-functional input is critical to validating problem statements and correctly identifying root causes.
Pat advised, “Your audit work might get you to 60% or 70% of the root causes. But when you get the right team members in the room, other issues surface that you wouldn't have captured organically through your test work.”
Also, set the right tone.
This isn’t an audit. It’s a problem-solving exercise designed to make the business better. Pat actually tells stakeholders, “I want to make your life better.”
Step 3: Identify Categories of Potential Causes
- Draw lines outward from the fish’s spine. These “bones” represent different categories of potential causes. This American Society for Quality (ASQ) article has good visuals.
- Label each bone with a different category. This helps steer and organize your analysis. Pat suggests always including the “big three” of people, process, and technology alongside any other categories that make sense for the problem you’re trying to solve.
Step 4: Brainstorm Potential Causes
Brainstorm possible causes — working hypotheses — in each category. Microsoft Copilot and ChatGPT can help spur ideas.
Take care to avoid judgment and establish a safe space for constructive discussion.
You’ll build trust and get the real story.
Pat’s detailed fishbone analysis template can help you think through possible causes. (Internal Audit Collective members can download it from the Templates Library.) Pat’s categories in overview:
- People: Think about it not as assigning individual blame, but as the systematic human factors that affect how well controls operate.
- Process: What breakdowns may have caused the gap? Instead of looking like full-blown failures, weak processes often show up as variation or inconsistent application.
- Technology: Look past “the tool didn’t work” to think about design, configuration, and monitoring. Many conditions stem from how systems are set up and managed.
- Governance: Issues often manifest as ambiguity (unclear rules), fragmentation (different practices across BUs), or weak enforcement (rules exist but aren’t applied).
- Communication: Did everyone who needed to know actually know? When did they know? Good processes fail when communication breaks down.
- Environment: Look for behavior patterns shaped by culture — often the culprit when issues persist even after new policies, training, or tools are introduced.
- Other: If something doesn’t fit these categories but seems relevant, capture it here.
Step 5: Validate and Confirm Root Causes
Can you back up root causes with actual evidence (e.g., testing results, metrics, spot checks)? Opinions don’t make good hypotheses — evidence does.
- Collect evidence to validate or rule out each hypothesis.
- Gain stakeholder agreement on root causes. Stakeholders are unlikely to act on recommendations if they don’t believe they address the real issues.
Step 6: Prioritize Potential Root Causes
What are the systemic, high-impact items that are really driving the risk?
Many root causes may seem valid, but they don’t all deserve your time and focus.
- Which changes will have the most impact?
- Which are easily implemented but still impactful?
Step 7: Identify Recommendations That Fix the Whole Problem
- Solicit cross-functional input to brainstorm solutions for priority issues.
- Encourage dialogue. “Here’s how I think we can fix it. Do you agree? Will it work?”
- Identify and agree on immediate follow-ups, recommendations, and any additional data required for validation.
- Integrate validated root causes into audit findings, ratings, and recommendations.
Step 8: Documentation
Simple analyses can be documented right in the workpapers. More complex analyses may be better as standalones.
Step 9: Stakeholder Feedback
Ask what you did well and how you can do better.
Engaging stakeholders will help build relationships — and establish your team as trusted advisors.
WHY THIS WORKS: The Fishbone Fleshes Out the Whole Picture
Pat nailed it: “The nice thing about this approach is it’s visual in nature. It’s easy to help teams see the bigger picture, both from your team’s and the client’s perspectives. And it prevents us from jumping too quickly into one root cause without exploring other dimensions.”
THE LAST WORD: Empower Your Team With Critical Thinking Tools
Pat strives to design his team’s fieldwork workflow to make their audit results predictable, consistent, and impactful. That also requires giving his team tools and guidance that empowers them to zero in on what’s important and own their processes with confidence.
Pat is clear: Fishbone analyses definitely require serious coaching and hands-on involvement from leadership.
But in his experience, it’s well worth the effort.
Why not try it for your next multifactor root cause analysis?
The Internal Audit Collective’s “Foundations” program provides cohort-based training on practice fundamentals (and 16 CPEs!) for new and seasoned Internal Auditors. Register today — the next session kicks off November 17.
