Consider Root Causes from the Start of Any Assignment

Consider Root Causes from the Start of Any Assignment

Nancy Haig explains her 80/20 approach to audits utilising RCA insights:

'RCA thinking should start as an engagement is conceived, utilising the “working hypothesis” concept spelled out in the “Lean Auditing” book. Otherwise, you miss many opportunities to focus your work and add value by waiting until the end of the assignment to do your RCA.

This is part of my “80/20 rule” for the successful completion of IA engagements, which means that approximately 80% of time should be spent on planning and approximately 20% on execution. While the percentages may not be exact, they clearly demonstrate the focus on planning and critical thinking rather than “test” work just in detail, without seeing the bigger picture.’

Within an assignment’s scope, RCA tools such as the Bowtie, modified fishbone, or eight ways to understand why can help focus work on the key objectives.

Furthermore, as you do background work on an assignment, consider the following points:

1. Suppose you are auditing an area with known concerns. In that case, you need to be wary of just validating this, where you might get the reaction, ‘We already knew about that’.

So, for known risks, issues and action plans in progress, clarify whether management has considered the root causes for these gaps (using a recognised methodology) and whether their current action plans are just ‘quick fixes’ or really address underlying causes.

That way, if an audit looks at known gaps, it can either (i) check any management RCA or (ii) examine the root causes of those issues as part of the assignment. 2. In relation to scope areas where no serious issues have been identified at first, consider: What kind of hairline cracks might arise that would result in an issue or a risk being out of tolerance?

With the scope and context established, consider the following questions:

1. Are the goals relevant to the assignment scope clear? For example, has the risk appetite been established, and have the implications of this translated into relevant management key performance indicators (KPIs) and key risk indicators (KRIs)?
2. Is there a possibility that any relevant management information (and KPIs and KRIs) is missing, or is potentially misleading, or incorrect?
3. Is there any suggestion that roles, responsibilities, accountabilities and authorities (R2A2) for key risks or processes are unclear?
4. When was the design of any relevant process, policy, or procedure, or IT system last reviewed? For example, is each key control SMART?
5. Are there enough key controls overall? For example, have controls been mapped against a Bowtie diagram (i.e. prevent, detect and recovery) and then checked the risk appetite (so you can do a design assessment)?
6. How have any relevant external factors or third parties been considered, monitored and managed?
7. Any questions about change or maintenance that may impact the area?
8. How have human factors relevant to the scope and objectives been appropriately considered by management?
9. Any signs of resource constraints, unclear priorities or dilemmas? How does the organisation prioritise tasks (related to objectives but also GRC issues)?

The important message is to ‘start the ball rolling’ with these RCA questions at the start of an assignment and on an ongoing basis so that:

1. You can be clear, using a boundary diagram (or ‘audit’ on one page), that the scope and objectives of the assignment will address some of the critical hairline cracks or opportunities for improvement and
2. As the assignment progresses, you should already have a good idea, with some evidence, of what the causal factors for improvement might be.

Starting these questions early can reduce the need to investigate causes at the end of an assignment. Paterson reports that this accelerated audits when he was the CAE of AstraZeneca, as described in ‘Lean Auditing’.