Root Cause Analysis (RCA) for Internal Audit Challenges
Apply root cause analysis to uncover deeper cultural and systemic issues behind common internal audit team problems, such as delays in information provision, management tick-box attitudes, and scope conflicts.
THE IDEA
Applying RCA to Day‐to‐Day Challenges the Audit Team Encounters
Internal audit (IA) teams can use root cause analysis to examine the cultural patterns behind recurring problems. Common challenges include:
- Conflicting expectations among local management, senior management and the audit committee about an IA assignment’s scope and timing;
- Questions about who the IA team should interview during an assignment;
- Management monitoring or second‐line checking by risk or compliance lacks the necessary rigour;
- Delays in getting the organisation to provide the audit team with information on time (often a problem for some IA teams rather than regulators or external auditors).
- Questions about the importance of audit observations and any ratings;
- Questions concerning action owners and how quickly remediation should be completed;
- The IA team is disappointed that management doesn't seem to take the audit process and follow‐up actions as seriously as they should.
In each case, there is usually more to these problems than meets the eye. To give two examples:
- Suppose there are delays in getting information (the fourth item). Is there any agreement on how quickly information should be provided to the audit team and what are the consequences if information is not provided on time?
Many IA teams are now designing audit protocols to include turnaround times, and if there are delays in providing information, this is reported upwards as part of the audit process. In fact, many audit teams call out ‘risk culture’ or ‘control environment’ in their reports, starting with turnaround times, but also looking at management openness about risks and areas of concern, and the management attitude to understanding root causes, remediation tracking, etc.
- Do managers treat risk and control and audits as tick-box exercises, only complaining if the audit rating is negative (the third and fifth items)?
Faced with such problems, some chief audit executives have changed their rating frameworks to make it clearer what might be reasonably expected and highlight that the goal should be to aim for leading or ‘in control’ behaviours where possible. Diagram C.2 illustrates how such a rating framework can work.
Where the design of ratings has been changed, line managers will often find they can no longer sit in a ‘comfort zone’ of doing the minimum to get by. In other words the design of ratings creates new information for senior stakeholders that can highlight important priorities and as a result change management behaviour.
Diagram C.2 Progressive approach to assignment ratings
When to use it
Identifying root causes of delays in information provision from management to internal audit.
Investigating why management treats audits as tick-box exercises and only reacts to negative ratings.
Improving audit scope and timing negotiations by uncovering underlying power dynamics between local management, senior management, and the audit committee.
Enhancing the effectiveness of audit observation ratings by redesigning frameworks to promote leading behaviors.
FROM THEORY TO EVERYDAY LIFE
In practice
Delays in information provision
An internal audit team consistently experiences delays in receiving requested information from management. Applying RCA reveals that there is no agreed-upon turnaround time or consequences for non-compliance. The audit team designs protocols that include turnaround times and reports delays upward, eventually surfacing deeper issues about management's attitude toward risk and control.
Management's tick-box approach to audits
Managers treat risk, control, and audits as mere formalities, only raising complaints when the audit rating is negative. RCA leads the Chief Audit Executive to redesign the rating framework to make expectations clearer and incentivize 'in control' behaviors, moving managers out of their comfort zone and changing their behavior.
A MOMENT TO REFLECT
Put it to work.
Think of a recurring problem in your audit team. What surface-level symptoms are you addressing, and what deeper cultural or systemic causes might you be missing?
How could you change the design of audit ratings or protocols to reveal underlying issues and shift management behavior?
What formal or informal agreements exist in your organization about information turnaround times, and what happens when those are breached?
CONTINUE THE CONVERSATION
Source texts
- Beyond the Five Whys Root Cause Analysis and Systems Thinking (James C. Paterson)