Root Cause Analysis & Internal Auditing PETER DRUCKER, KAORU ISHIKAWA AND THE CRITICAL IMPORTANCE OF ROOT CAUSE ANALYSIS IN THE INTERNAL AUDIT OF IRISH CREDIT UNIONS The study of the origin of words (etymology) is a wonderful thing. Many who are advocating within the credit union movement for a greater presence in the mortgage market, may be interested to know that the word “mortgage” originates from old French and means, literally, “dead-pledge”. You borrow money to buy a property, long-term, and either repay it in full, or die, whichever comes first. Another interesting word for those in the credit union movement is the word “effective”. The word appears no less than 31 times in the Credit Union Act 1997 (as amended). Of particular interest to internal auditors, is that the Act specifies that internal audit should result in an “improvement in the effectiveness of internal control”. Furthermore, the Act specifies that the Board of a credit union should ensure that internal audit itself, is effective, in achieving this objective. In a rather circular fashion, the credit union must ensure that internal audit is effective at telling it how to improve its own effectiveness. So what does effective mean? Enter the curious world of etymology. Etymology teaches us that “effective” originates from the Latin word “efficere”, meaning to accomplish. The word “efficient” also originates from the Latin word “efficere”. But in modern day parlance, the words “efficient” and “effective” mean two very different things. This is famously (and rather brutally) explained by Peter Drucker, the famous Vienna born American author in 1963, when he said “…It is fundamentally the confusion between doing the right things and doing things right. There is surely nothing quite so useless as doing with great efficiency what should not be done at all…”. Drucker goes on to label the practice of doing the wrong thing efficiently, as “unpardonable profligacy”. So to leverage on the words of Drucker, effectiveness means doing the right thing. So how do internal audit and credit unions endeavour to avoid unpardonable profligacy by doing the wrong thing efficiently? Nothing quite beats a good epiphany (for budding etymologists, “epiphany” has a mixture of Latin and French origins), and our internal audit team at Moore would view that a relatively recent Practice Advisory Note issued by the Institute of Internal Auditors on Root Cause Analysis has had an epiphany-like impact on our perspective on how to best ensure the effectiveness of internal audit. The Practice Note sets out the following comments on internal audit, in its generality, and the relevance of Root Cause Analysis (quoted verbatim, we have not even adjusted for USA English): Root cause analysis is defined as the identification of why an issue occurred (versus only identifying or reporting on the issue itself). In this context, an issue is defined as a problem, error, instance of noncompliance, or missed opportunity. Auditors whose reporting only recommends that management fix the issue – and not the underlying reason that caused the issue – are failing to add insights that improve the longerterm effectiveness and efficiency of business processes and thus, the overall governance, risk, and control environment. A core competency necessary for delivering insights is the ability to identify the need for root cause analysis and, as appropriate, actually facilitate, review, and/or conduct a root cause(s) analysis. Internal audit can be the ideal group to analyse issues and identify the root cause(s) given their independence and objectivity. This perspective helps ensure biases are minimized, assumptions are challenged, and evidence is fully evaluated. Additionally, internal auditors – by working across various reporting chains and departments of an organization – may have developed a broad and deep understanding of the underlying issue(s) that may exceed that of any single member of management, which makes them best positioned to analyse the issue. In circumstances where the root cause of an issue is a result of actions or inaction of management, it is critical to use an objective party, such as internal audit, to investigate and report back to senior management. Root cause analysis benefits the organization by identifying the underlying cause(s) of an issue.This approach provides a long-term perspective for the improvement of business processes. Without the performance of an effective root cause analysis and the appropriate remediation activities, an issue may have a higher probability to reoccur. We would encourage the above to be carefully considered. These points are likely to resonate deeply with Irish credit unions. We have previously written about the phenomenon of “audit fatigue” in an article on assurance mapping and the reality that in contemporary Ireland’s highly regulated Irish credit union, one could surmise that vast stretches of the working year are spent managing audits/reviews/assessments of some shape or form. In this regard, moving reporting functions from being cataloguers of problems, to inventors of solutions, is a subtle but major shift in orientation. In this regard the following could be reasonably stated: Internal auditors should move beyond issue identification. Internal auditors should see their true objective as being future issue prevention. Recommendations should go beyond being the inverse of the issue. Let’s illustrate by example. Let’s say Internal Audit reviewed 40 loan files and noted 7 loan files did not have proof of income on file to prove the member had the ability to repay the loan. Here are some possible internal audit outcomes: Internal audit notes 7 loan files did not have proof of income. In this manner the credit union is now aware of an issue (Outcome 1, the issue is identified). Internal audit notes 7 loan files did not have proof of income and recommends that in future the credit union ensures all loan files have proof of income (Outcome 2, the issue is identified, and the recommendation is simply an inverse of the issue). Internal audit notes 7 loan files did not have proof of income, carefully considers why this happened, and recommends steps to ensure it does not happen again (Outcome 3, the issue is identified, and a recommendation is sought that ensures the issue will not reoccur). Internal audit must be effective at improving the effectiveness of the internal controls of credit unions. In this context, it is likely that all would agree that Outcome 3 is the more desired outcome. It is not that Internal Audit becomes the holder of a magic wand to prevent all future reoccurrence of the issue. In this regard, the Practice Note comments as follows: Determining true root cause may be difficult and subjective – even when significant quantitative and qualitative data is available. Auditors should strongly consider including the input from multiple stakeholders of the business process in the design, analysis, and evaluation of data. Multiple errors with varying degrees of influence may be the root cause of an issue. The internal auditor may, in some cases, provide multiple conclusions of fact along with multiple scenarios for management to consider as the root cause of an issue. In these circumstances, value provided by internal audit is the independent and objective evaluation and presentation of various data and analysis from which management may draw a conclusion on the most probable root cause. So how is this done? This is where a Professor from the University of Tokyo by the name of Kaoru Ishikawa becomes relevant. There are a number of different techniques to complete Root Cause Analysis, but none as exotic or alluring as that of Professor Kaoru Ishikawa. Ishikawa, created the “Fishbone Analysis” in the 1960s. The Fishbone Analysis presents the “issue” as a fish-head, facing the right, with the causes extending to the left as fish bones. The major causes are ribs branching off the backbone, with sub-branches for root causes. At its inception, the fishbone had 5 main causes, referred to as the “Five Ms”: Man, machine, material, method or measurement. Later this was enhanced to at a 6th, “Mother Nature” (if you are struggling to visualise this, see overleaf).. The idea being that one is forced into a structured, disciplined and systematic process to identify what causes the issue. One must repeatedly ask “why?”. The classic example being as follows: The worker fell, why? Because of the oil on the floor, why? Because of a broken part, why? Because the part keeps failing, why? Because of changes in procurement practices. By the fifth “why”, the internal auditor should have identified or be close to identifying the root cause. Set this in the context of the above example of the loan file test, where 7 loan files did not have proof of income on file. If a more meaningful root cause analysis is completed, it may emerge that the root cause of the issue may identify the need for more training (“man”), an ICT enhancement to put a banking system control in place (“machine”), or a simple policy change (“method”). But the larger issue is that simply calling the issue (issue identification) or recommending non-recurrence (inverting the issue) is not likely to be good enough, in longer term horizons. Internal audit must provide insights, and move beyond the issue identification. “Effectiveness” is an operative word when it comes to positioning the role of internal audit in Irish credit unions. It is written in law. As Drucker points out, we must all avoid the unpardonable profligacy of doing the wrong things efficiently, but instead do the right things. The famous author, VS Naipaul once said “small things start us in new ways of thinking“. Professor Ishikawa and his fishbone analysis will be etched in our thinking at Moore as internal audit continues its evolution in Irish credit unions. Let’s start asking why (at least 5 times)… Brian Hayes | Partner | Cork Brian.Hayes@mooreireland.ie +353 21 427 5176