Root Cause Analysis: The Essential Ingredient Las Vegas IIA Chapter February 22, 2018 Agenda • Overview . Concept . Guidance . Required Skills . Level of Effort . RCA Process . Benefits . Considerations • Planning . Information Gathering • Fieldwork . RCA Tools and Techniques • Reporting . 5 C’s Screen 2 of 65 OVERVIEW Root Cause Analysis (RCA) A root cause is the most reasonably identified basic causal factor or factors, which, when corrected or removed, will prevent (or significantly reduce) the recurrence of a situation, such as an error in performing a procedure. It is also the earliest point where you can take action that will reduce the chance of the incident happening. RCA is an objective, structured approach employed to identify the most likely underlying causes of a problem or undesired events within an organization. Screen 4 of 65 IPPF Standards, Implementation Guide, and Additional Guidance IIA guidance includes: • Standard 2320 – Analysis and Evaluation • Implementation Guide: Standard 2320 – Analysis and Evaluation Additional guidance includes: • PCAOB Initiatives to Improve Audit Quality – Root Cause Analysis, Audit Quality Indicators, and Quality Control Standards Screen 5 of 65 Required Auditor Skills for RCA Collaboration Critical Thinking Creative Problem Solving Communication Business Acumen Screen 6 of 65 Level of Effort The resources spent on RCA should be commensurate with the impact of the issue or potential future issues and risks. Screen 7 of 65 Steps for Performing RCA 04 02 Formulate and implement Identify the corrective actions contributing to eliminate the factors. root cause(s). 01 03 Define the Identify the root problem. cause(s). Screen 8 of 65 Steps for Performing RCA Risk Assessment Root Cause Analysis 1. Objective 1. Problem 2. Risk(s) 2. Root Cause(s) a) Identification a) Identification b) Measurement b) Measurement c) Prioritization c) Prioritization 3. Risk Response 3. Recommendation/Management Action Plan Screen 9 of 65 Benefits of RCA RCA benefits the organization by identifying the underlying cause(s) of an issue. This approach provides a long- term perspective for the improvement of business/control processes. Without the performance of an effective RCA and the appropriate remediation activities, an issue may have a higher probability to reoccur. Screen 10 of 65 RCA Considerations Prior to performing RCA, internal auditors should anticipate potential barriers that could impede the effort and proactively develop an approach for handling those circumstances. Skill Sets Resistance From Time Management Commitment Independence Subjectivity Screen 11 of 65 PLANNING What Is a Process? INPUT A process is generally defined as a series of steps or actions performed to achieve a specific purpose. The TRANSFORMATION components of a process, including a control process are: • Input • Transformation • Output OUTPUT Screen 13 of 65 Tool: SIPOC Diagram A SIPOC diagram is a high-level Suppliers process map that provides a systematic way to analyze and describe the input and output Inputs relationships of process steps. It provides a graphical representation Process of the interrelationships of activities of the suppliers and customers and focuses on the interrelationship Outputs between those activities. Customers Screen 14 of 65 Tool: SIPOC Diagram Screen 15 of 65 Steps for Creating a SIPOC Diagram 1 2 3 4 5 Identify the List the key In the process Brainstorm the customers that outputs of each Clarify the start column, map the key outputs and will receive the step of the and stop of the 5 to 7 major customers for outputs and list process in the process. process steps in each major in the corresponding sequence. process step. corresponding row/column. row/column. Identify the Review the Brainstorm the List the key suppliers that completed key inputs and inputs for each provide the SIPOC to verify Determine the suppliers for key output in the inputs and list in all key areas of focus. each key output corresponding the components are identified. row/column. corresponding completed/ row/column. addressed. 6 7 8 9 10 Screen 16 of 65 Tool: FMEA Failure modes and effects analysis (FMEA) is a systematic tool used to evaluate a process and identify where or how it might fail, and to assess the relative impact of the failure. • Similar to a risk and control matrix in internal auditing. • Failure modes are any errors or defects in a process design, especially those that affect the intended function of the process, and can be potential or actual. • Effects analysis refers to studying the consequences of those failures. Screen 17 of 65 FMEA – Failure Prioritization Failures are prioritized according to: • How serious their consequences are • How frequently they occur • How easily they can be detected Screen 18 of 65 Example – FMEA Worksheet 2 5 8 9 10 Identify failure modes Identify causes of the Rate ability to Calculate RPN and Determine and and their effects failure modes detect prioritize assess actions and controls Screen 19 of 65 Steps for Performing an FMEA 1. List the key process step. 2. Identify what could go wrong in that step (potential failure mode). 3. Identify the possible consequence(s) (potential failure effect). 4. Assign a severity rating. 5. Identify the potential cause of a failure mode. 6. Assign an occurrence rating. 7. Document the present controls in place that prevent failure modes from occurring or detect the failure before it reaches the customer of the process. 8. Assign a detection rating. 9. Calculate the risk priority number (RPN). 10.Recommended actions are planned to lower high-RPN (high risk) process steps. Screen 20 of 65 Severity Rating Description of Severity Recovery Severity Reputational Impact on Score Organizational & Stakeholders (i.e., What Would it Take Rating EBIT Duration Impact on Value Operational Scope customers, shareholders, to Recover? employees) Enterprise-wide; Complete loss of Catastrophic Complete inability to 9/10 > $200M Irrecoverable confidence in all 3 Collapse of market Acquisition or business operations groups. enterprise. 2 or more divisions; 2 or more changes Recoverable Significant, ongoing > 50% reduction in Sustained losses in 2 or senior leadership, 7/8 Critical < Long Term interruptions to capitalization, accessing stakeholder groups. restructuring, 24-36 operations within 2 or $2 billion liquidity reserve. changes to strategic divisions >25% reduction in market 1 or more changes Recoverable 1 or more division(s); capitalization, senior leadership, Moderate loss in 1 or more 4/5/6 High < Short Term Moderate impact within minimal operating cash significant changes stakeholder groups. 12-24 more division(s). maintenance of $2 billion operating plans and reserve. execution. Temporary Refinements or 1 division; Limited to minor/short- 2/3 Moderate < $50M less than 12 Miss forecast(s) and/or adjustments to Limited impact within 1 1 stakeholder group. months) plans and 1 Minimal < $20M Minimal Impact Occurrence Rating Score Occurrence Rating Percentage 9/10 Very high (failure is almost inevitable) > 90% 7/8 High (repeated failures) < 90% 4/5/6 Moderate (occasional failures) < 60% 2/3 Low (relatively few failures) < 30% 1 No known occurrences on similar processes < 10% Detection Rating Score Detection Rating Description Controls are non-existent or have major deficiencies and 9/10 Failure will be passed onto customer intended 7/8 Low Limited controls in place, high level of risk remains 4/5/6 Moderate Key controls in place, with significant opportunities for Controls properly designed and operating, with opportunities 2/3 High identified 1 Certain – Failure will be caught by control Controls properly designed and operating as intended FIELDWORK RCA Fieldwork Tools and Techniques Simple techniques such as inquiry and observation are useful for determining the root cause in many of the issues to be analyzed. More elaborate RCA tools and techniques should be reserved for situations where the benefit outweighs the cost. Examples of these types of tools and techniques include: • The 5 Whys • Fishbone diagram • Fault tree analysis • Pareto chart • Scatter diagram • Cause and Effect Matrix • Business Process RCA Screen 25 of 65 Tool: The 5 Whys • The 5 Whys is a questions-asking technique used to explore the cause/effect relationships underlying a particular problem, with the goal of determining a root cause of a defect or problem. • By repeating why five times, the nature of the problem as well as its solution usually becomes clear. • Ask "why" and identify the causes associated with each sequential step towards the defined problem or event. • "Why" is taken to mean "What were the factors that directly resulted in the effect?" Screen 26 of 65 The 5 Whys – Questions-Asking Method The following examples demonstrates the basic process of the 5 Whys: The vehicle will not start. (the problem) • The alternator The vehicle was belt was well not maintained The battery is The alternator is The alternator beyond its useful according to the dead. not functioning. belt has broken. service life and recommended (first why) (second why) (third why) not replaced. service schedule. (fourth why) (a root cause) • The worker fell. (the problem) By the fifth “why,” Changes in the internal auditor There was oil on The part keeps A broken part. procurement should have the floor. failing. (second why) practices. identified or be (first why) (third why) (fourth why) close to identifying the root cause. Screen 27 of 65 The 5 Whys Analysis – Jefferson Memorial Example Problem: The stones of the Jefferson Memorial are eroding! • Why are they eroding? o The frequent washing of the stone. • Why are the stones washed so often? o There are so many bird droppings on the stones. • Why are there so many bird droppings? o A large number of birds come around to eat the abundant food supply of little black spiders. • Why are there so many little black spiders? o To eat the millions of little midges around the memorial. • Why are there so many midges? o At dusk they turn on the lights at the memorial.