A fishbone diagram is a drawing that sorts the possible causes of one problem into groups, so a team can see all the candidates before choosing which to test. Auditors use it after finding an issue, to move from "what went wrong" to "why it keeps happening". The diagram only lists suspects; the evidence decides which one is guilty.
Last reviewed: 17 October 2026. Facts checked. We ran web searches on the fishbone method and on root cause tools used in internal audit, and read an article from the Chartered IIA (UK) and the Wikipedia page on the Five Whys. ASQ's own fishbone page returned a 403 error, so we could not open it; the six category names come from search summaries of it. We did not open the IIA's Global Internal Audit Standards. The worked example is invented for teaching.
What a fishbone diagram is
Picture a fish skeleton lying on its side. The head on the right holds the problem. The long spine runs left. Branches ("bones") come off the spine, each labelled with a group of causes, and smaller lines on each bone hold the individual causes.
Kaoru Ishikawa, a Japanese quality expert, popularised it in manufacturing in the 1960s, which is why it is also called an Ishikawa diagram or cause-and-effect diagram. ASQ lists it among its basic quality tools. Its strength is breadth: it makes a team think about causes across the whole process, not just the first one that comes to mind.
The six common bones
The classic labels are the "6 Ms" from manufacturing. Sources vary on exact names, and you should rename them to suit the problem. In an audit or finance setting, they translate like this.
| Bone | Plain meaning | Audit and finance version |
|---|---|---|
| Manpower (people) | Who does the work | Training, workload, segregation of duties, staff turnover |
| Method | How the work is done | Written procedure, approval steps, month-end checklist |
| Machine | Tools and systems | ERP settings, Tally or SAP configuration, spreadsheets |
| Material | Inputs to the process | Source documents, master data, vendor details |
| Measurement | How performance is checked | Reports, reconciliations, review thresholds |
| Environment | Outside conditions | Deadlines, regulation, vendor behaviour, remote teams |
Not every bone will have causes. An empty bone is useful too: it tells you that you looked.
How to build one in five steps
- Write a narrow problem statement. "Payments are late" is too wide. "Vendor invoices above the approval limit are paid after the due date" is testable.
- Draw the spine and the bones. Start with the six above, or replace them with headings that fit your process.
- Brainstorm causes with the process owners. People who do the work know where it breaks. Write every idea on a bone, even weak ones.
- Go one level deeper where needed. For each likely cause, ask why it happens. This is where the 5 Whys method fits inside a fishbone.
- Mark the causes to test. Pick the causes you can check with data or documents. Do not conclude from the diagram alone.
Worked audit example
An internal audit of accounts payable finds that approvals for larger vendor invoices are often completed after the due date. The problem statement for the head of the fish: "Approvals above the limit are completed after the payment due date."
| Bone | Possible causes raised in the workshop | How we would test it |
|---|---|---|
| Manpower | Only one senior approver; no named backup during leave | Compare approver leave dates with delayed invoices |
| Method | Approval is requested by email, not logged; no escalation after a few days | Read the procedure; trace a sample of delayed invoices |
| Machine | System does not alert the approver; no approval queue report | Walk through the workflow in the system |
| Material | Invoices arrive without a purchase order or goods receipt, so the approver sends them back | Count returned invoices and the stated reason |
| Measurement | Nobody reports ageing of invoices awaiting approval | Ask for any ageing report; check who sees it |
| Environment | Vendors send bulk invoices at month end | Look at invoice receipt dates by day of month |
After testing, the audit team finds that the main causes sit in Method (no escalation rule), Machine (no alert) and Measurement (no ageing report). The Manpower and Environment causes exist but explain few of the delays. These findings are not made up of opinions: each one rests on a document, a walkthrough or a data extract.
From diagram to audit finding
The diagram feeds the "cause" part of an observation. Auditors usually state condition, criteria, cause and effect, and the cause is the part that tells management what to fix. Our guide to writing audit observations shows how to turn a tested cause into a clear sentence.
Two cautions:
- Do not stop at a person. "The approver was careless" is rarely a root cause. Ask what in the process allowed the delay.
- Expect more than one cause. Most real problems have several, which is why a single chain of questions can mislead and a fishbone helps.
When a fishbone is the wrong tool
A fishbone is weak when the problem is simple and has one obvious cause, or when you have no access to the people involved. It also does not rank causes. To rank them, count how often each tested cause shows up in the data and focus on the biggest. For a comparison with other methods, see our wider guide to root cause analysis methods in internal audit.
If you want a place to record the risk behind the problem, the internal audit observation report generator can hold the cause and recommendation together.
Frequently Asked Questions
What is a fishbone diagram in simple words?
It is a drawing of one problem at the "head" and its possible causes grouped on branches. It helps a team list causes in an organised way before testing them.
Is a fishbone diagram the same as an Ishikawa diagram?
Yes. Other names are cause-and-effect diagram and, from the shape, herringbone diagram.
Do I have to use the six Ms?
No. They are a starting set from manufacturing. Rename or replace them with headings that fit your process, such as people, process, systems, policy and data.
How is a fishbone different from the 5 Whys?
A fishbone spreads wide across many cause groups. The 5 Whys goes deep along one chain of causes. Auditors often use both: the fishbone to find candidates, the 5 Whys to dig into the likely ones.
Does a fishbone prove the root cause?
No. It is a thinking aid. A cause is only a root cause once you have evidence for it, such as records, data or walkthroughs.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error