How Root Cause Analysis Fits Into Various Audit Types

It is often said that the true audit work is not just finding the things that have gone or may go wrong in the organization; true auditing involves finding the root causes of the discoveries made by auditors. Only then can auditors formulate relevant recommendations to either prevent or detect and correct issues at hand. Helping management address the root causes of undesirable conditions ensures that the internal audit function is perceived as “an activity designed to add value,” as defined by the Institute of Internal Auditors’ (IIA) International Professional Practices Framework (IPPF). Internal auditors should be the ones who are most independent and objective. Therefore, auditors should be among those with the broadest and deepest understanding of the underlying issues that may exceed that of any single member of management.

As the IIA Practice Advisory 2410-1 states, the observations and recommendations are based on four attributes: criteria, condition, cause and effect. So, what is the purpose of the root cause analysis? And how is the most value-adding root cause analysis best performed while avoiding assumptions, speculations and plain guessing? It is worthwhile to further discuss the role that the root cause analysis plays in different types of engagements performed by auditors.

Learn More