Root cause analysis (RCA) asks why a control failed, not just that it failed, so the fix removes the cause instead of the symptom. No single method fits every finding: use the 5 Whys for short chains, a fishbone for many possible causes, Pareto to rank repeated issues, and a bowtie or fault tree when several controls failed together. This guide shows how to choose.
Last reviewed: 17 October 2026. Facts checked. We ran a web search on RCA methods in internal audit and opened an article from the Chartered IIA (UK) and the Wikipedia page on the Five Whys. Training-provider pages and an IIA podcast listing came up in search but we did not open them. Several sources say the Global Internal Audit Standards expect root cause analysis, but we did not open the Standards and cannot cite a section. The examples are invented.
Why root cause matters in internal audit
An observation without a cause leads to a weak recommendation. "Reconciliations were late" invites the reply "we will be on time next month". "Reconciliations were late because the statement download is not owned by anyone" leads to a fix that lasts. Root cause is the "C" in condition, criteria, cause and effect, covered in our guide to writing audit observations.
The Chartered IIA article adds two cautions. Do not treat one person's error as the root cause; ask whether the surrounding arrangements were adequate. And labels such as "people, process and systems" say where a problem sits but not why it happened.
The main methods
| Method | What it does | Best for | Watch out for |
|---|---|---|---|
| 5 Whys | Asks why repeatedly along one chain | Simple, single-path problems; a quick first pass | Depth is arbitrary; can hide other causes |
| Two-leg (or three-way) 5 Whys | Runs the chain for prevention and for detection (and sometimes recovery) | Control failures, where more than one control should have caught it | Needs evidence for each leg |
| Fishbone | Groups many possible causes on branches | Brainstorming with process owners; thematic grouping | Lists suspects; does not rank or prove |
| Pareto analysis | Ranks causes by how often they occur | Repeated issues with data available | Needs enough data; counts, not reasons |
| Bowtie | Maps threats, the event, consequences and the controls on each side | Showing why several preventive and detective controls failed | Takes longer to draw |
| Systems thinking | Looks at links across teams and the whole organisation | Issues that keep coming back | Wider scope; may extend the assignment |
The method names and uses above follow the Chartered IIA article for the 5 Whys, two-leg approach, bowtie, fishbone and systems thinking. Pareto is widely used in quality work and was named in the IIA material surfaced by search; we did not open a page that explains it in an audit setting.
How to choose
Ask three questions.
- How many causes could there be? One obvious path points to the 5 Whys. Many possible causes across people, systems and policy point to a fishbone.
- Did controls fail? If a control should have prevented or caught the issue, use the two-leg approach or a bowtie so you ask both "why not prevented" and "why not detected".
- Is there data on many cases? If you have a population of exceptions, sort them by cause and use Pareto to see which causes account for most of them.
If an issue returns year after year, treat that as a sign of a deeper, system-level cause and consider the wider view.
A combined worked example
Finding: Expense claims are approved without receipts.
- Fishbone, to widen the view. Causes raised: the claim form does not force an upload (Machine), the policy says receipts are needed only above a limit nobody remembers (Method), approvers are rushed at month end (Environment), no report lists claims without attachments (Measurement).
- Pareto, to rank. The team lists all claims without receipts for the period and tags each by reason. The reasons that show up most become the focus.
- Two-leg 5 Whys, to explain the controls. Why not prevented? The form allows submission without an attachment. Why not detected? No review checks for missing attachments.
The recommendation now has two parts: a form change that prevents the gap and a periodic exception report that detects it. Each part rests on evidence kept in the working papers, not on opinion.
Good practice
- Start RCA at scoping. The Chartered IIA article suggests thinking about root cause when you plan the assignment, so causes that cross departments do not force a mid-audit scope extension.
- Use evidence for every cause. Records, system reports and walkthroughs, not assumptions.
- Weigh cost against benefit. A root-cause fix can be bigger than a quick fix, so consider the potential impact of the weakness and not only what it has cost so far.
- Keep it proportionate. A low-risk, one-off error does not need a full workshop.
For how RCA sits inside fieldwork, see the operational audit guide. To judge how serious the weakness is once you know the cause, see control deficiency, significant deficiency and material weakness. The internal audit observation report generator can help you write up cause and recommendation.
Frequently Asked Questions
What is root cause analysis in internal audit?
It is the work of finding why a control or process failed, so the recommendation fixes the cause. It sits between finding an exception and writing the recommendation.
Which RCA method is best for auditors?
There is no single best one. Start with the 5 Whys for simple issues, use a fishbone for many possible causes, and use the two-leg approach when controls failed.
How many root causes should I expect?
Often more than one. Sources in internal audit practice stress that a single-cause answer is rarely complete, especially when controls failed.
Is root cause analysis required by auditing standards?
Several sources say the IIA's Global Internal Audit Standards expect it, but we did not open the Standards to confirm the wording. Check the current text before citing it.
Can statutory auditors use these methods?
Yes, for understanding why misstatements or control failures happened, which helps the auditor judge whether they are isolated or widespread.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error