Skip Ribbon Commands
Skip to main content
The Institute of Internal Auditors North AmericaBreadcrumb SeparatorLearning and EventsBreadcrumb SeparatorCoursesBreadcrumb SeparatorGetting to the Root of the Matter: Root Cause Analysis Techniques for Auditors
Course Description Course Outline Bring Us On Site  

Getting to the Root of the Matter: Root Cause Analysis Techniques for Auditors

Course Description

Print-friendly Course Description and Outline

In today’s audit environment there is a lot of discussion around audit functions “adding value.” Audits are time consuming, can be expensive, and often are a source of frustration for the audit client. Why? As auditors, we often hear that the “auditor just doesn’t understand my business.” The business can feel this way as a reaction to the proposed action and remediation plan. If an audit team doesn’t perform effective root cause analysis, then the recommended action often will not solve the root cause of the issue and problems will persist.

To truly add value, an audit must address the root causes of the issues and exceptions identified, not just the symptoms. This course is designed to introduce internal audit staff and management to the various tools and methodologies used for root cause analysis and how to apply them to the audit process. Participants will learn interactively through a combination of lecture, case studies, and exercises. 

Learning objectives for this course are:

  • Understanding root cause analysis (RCA).
  • Introduction to the various tools and methodologies that can be utilized for RCA.
  • Understand how and when RCA can be applied within audits.
  • Understand the common challenges when using RCA.
  • Learn how to apply RCA in practice.
Course Duration: 2 day(s)
CPEs Available: 16
Knowledge Level: Intermediate
Field of Study: Auditing
​Auditors with at least one year of experience to draw upon their professional audit knowledge.
Advance Preparation: 
Delivery Method: On-site Training (Group-Live)

Understanding Risk Cause Analysis (RCA)

  • What is it?
  • A very brief history and background of RCA.
  • Why should it be done?

RCA in Internal Audit – Why?

  • Business responsibility or internal audit’s?
  • Adding value.
  • When should you conduct an RCA?
  • At what point in an audit should the RCA be conducted? .
  • When to use RCA outside of an audit.

Standards and Best Practices

  • Overview of current IIA guidance.
  • IIA Practice Advisory 2320-2: Root Cause Analysis.

RCA Methodologies & Techniques Most Common in Audit

  • The 5 Whys.
  • Flowcharting – process flow, system flow, data flow.
  • Fishbone diagrams.
  • Pareto.
  • The 5 Cs.

Other RCA Methodologies

  • Failure Mode and Effect Analysis.
  • SIPOC.
  • Statistical Correlation.
  • Fault Tree Analysis.
  • Lean Six Sigma – critical to quality.
  • Normal Accident Theory.

The RCA Process

  • Define the issue.
  • Diagnose the issue using one of the methodologies.
  • Identify potential alternate solutions/recommendations.
  • Determine if an interim or permanent solution is viable.
  • Ensure appropriate controls for recommended solution.
  • Lessons learned.

Adding Value – Linking Root Cause to Findings and Objectives

  • Link the finding to its root cause.
  • Link the finding and root cause to the audit and business objectives.
  • Understand the control failure root causes.
  • Link control failure root causes to COSO 2013.

Common Challenges and Obstacles

  • Environmental obstacles.
  • Common mistakes.
  • Biases that impede RCA.
  • Drawing the wrong conclusion.
  • Resolutions that don’t resolve the issue.
  • Communication – interviewing, Q&A, follow up.

Communicating Root Causes

  • Including root cause in the audit report.
  • Action plans.
  • Difficult situations.

​Most courses can be delivered through on-site training. You might be surprised that the organization leading the profession is just as committed to the delivery of affordable training.​​

Contact us by calling +1-407-937-1388 or send an e-mail to​