Use Root Causes to Consolidate Observations and Improve Action Plans

By the end of an internal audit (IA) assignment, you should have:

1. a series of interesting observations and
2. a good understanding of the causal factors, already with some evidence to back this up.

In line with lean and agile auditing methodologies, you would be sharing these insights as you conduct the assignment. Then, you have a choice:

1. highlight observations and propose actions at the level of symptoms and/or
2. offer comments at the level of underlying causes and then propose actions at the level of root causes.

Addressing underlying causes may seem the obvious choice, but agreeing on an action plan can be more complicated in practice. Stephen Foster explains:

‘When it comes to working with stakeholders around action plans, recognise that they are dealing with multiple issues and priorities of which an IA finding, or findings, is just one of many. Therefore, they may just want to be offered a red pill, green pill or blue pill that will solve the organisations’ problems quickly.

Usually, we know that addressing underlying causes can't be done through this sort of magic panacea, and care should be taken in suggesting it can. But you should also be pragmatic; it is not in any one’s best interests for the opportunity to change and improve to be missed due to overwhelming decision‐makers with the scale of organisational change needed all at once. So, where the situation or issue permits, look for the vital few, or smaller, easier steps to get the momentum going, to give a sense of progress being made, and that are contributing to the longer‐term vision and goal. It is also important to remember that sometimes turning the tap off should be the first action before determining where and why a pipe is leaking.

They say management and senior executive attention spans can be as short as three weeks before they need to prioritise energies on the next major issue or opportunity. So, give senior management enough to keep them interested in investing in an area, keeping up the focus and energy. It's vital to remember IA work is about getting management to see the connection between GRC improvements and better business. This can be a multi‐year task that needs the stamina and endurance of the whole organisation, so don't always ask for “gold‐plated” perfect action plans to address all root causes the first time around; you can come back to some of those later; once the major risks are addressed, and people see the benefits of what has already been done.’

Richard Taylor offers a similar experience:

‘As your RCA becomes more powerful, you need to be even more disciplined about the right influencing strategy. For example, you may find improvements in one department and have the confidence of 60% that there is also a system‐wide change that could further help the situation. You might have been smart and engaged the IT department as part of the audit assignment and talked over your thoughts informally. If they are amenable to making changes, that is great, but sometimes budget and resource pressures will mean they can't yet make this a priority.

So, just because you can see that there might be room for improvement, that still doesn't mean that you are obliged to bring it up as an area for action, especially if (1) you don't have all the evidence you need to back up the causal connections and (2) you don't yet have a clear cost/benefit argument.

To my mind, it's best to think about the level of risk, the context and other work in progress in the business when you are proposing actions. And against this background, you can then think about the optimal way to build a persuasive case for action.

This is why thematic analysis of findings can be so powerful. After all, if the same factor comes up as a potential cause in several subsequent audits, you are building a stronger cost–benefit case for action.’

Diagram C.1 spells out the different levels of observation and action proposals an audit team can make at the end of an assignment. As you become experienced in incorporating RCA into audit assignments and management becomes more accustomed to hearing about root causes, it will be easier to focus on more systemic action plans. This normally results in a smaller number of action recommendations, and one CAE I know has a helpful motto: ‘In our audit reports, we are aiming for every finding only once’.

Several audit teams I have worked with have started to share some of the RCA working templates with managers (such as the Bowtie and modified fishbone) to explain what they have found. Jerome Lobet explains:

‘As a discussion tool towards the end of an audit assignment, the Bowtie appears to be working well. As we have adapted it, we can show both the hard and soft controls that are working well and less well.

Most of all, the managers we work with seem to find it quite easy to follow and quite fair and balanced because it gives them credit for what's working well. At the same time, we can show some of the “hairline cracks” we have found, but in a neutral, non‐attacking way, which is just what we hoped for.’

Diagram C.1 Some key ingredients of an internal audit report.