When a control fails, the first explanation is rarely the cause. "The reviewer was busy" describes a symptom. The 5 whys method asks why repeatedly until the answer points to something management can change in the design of the process. The IIA Global Internal Audit Standards do not name the method, but Standard 14.3 describes the same idea in its implementation text: at its simplest, determining the root cause involves asking a series of questions about why the difference exists, and identifying it involves collaboration with management, who may be in a better position to understand the underlying causes. This post turns that into a procedure.
Why root cause matters to the standards
Standard 14.3 requires internal auditors to collaborate with management to identify root causes when possible while evaluating each potential finding. The implementation text describes the root cause as an underlying or deeper issue than the direct reason the condition exists. Standard 14.4 lists addressing the root cause of the finding among the aims of the recommendations or action plans internal auditors determine with management. Fixing the direct cause alone produces the same finding next year. Standard 11.3 adds that findings across engagements may reveal themes such as root causes, and these must be communicated timely to the board and senior management.
The procedure
- State the condition precisely. "Eleven payments over $10,000 were released without the second approval the policy requires" is usable. "Approvals are weak" is not.
- Ask why, and write the answer as a fact. Each answer must be something you can test with a document, a system log or an interview that someone else could repeat.
- Ask why of that answer. Continue until you reach a cause that management controls and that, if changed, would have prevented the condition. Five is a guide. Three may be enough, and seven is sometimes needed.
- Test each link. For every answer, ask what evidence supports it. Untested answers are guesses that sound plausible.
- Check for branches. A failure often has more than one cause. Run a separate chain for each.
- Write the cause in the finding alongside criteria, condition and effect. See /us/blog/internal-audit-findings-criteria-condition-cause-and-effect-standard-14-3.
Example 1: payments released without second approval
Condition. In a population of 2,140 payments over $10,000, 11 were released with only one approver.
- Why were they released? The payment system allowed release with one approval.
- Why did the system allow it? A workflow exception was configured for "urgent" payments, and the approver could mark any payment urgent.
- Why was the exception configured? Eighteen months before the audit, treasury needed to make same-day tax payments while the second approver was traveling.
- Why was it never removed or restricted? The change was made by treasury through a service ticket, and no one outside treasury reviewed or approved it, and no periodic review of workflow settings exists.
- Why is there no review of workflow settings? The ITGC program covers user access and program changes but not configuration of approval workflows in the payment platform.
Root cause. The approval workflow configuration sits outside the scope of change management and access review. Action. Bring workflow configuration into change management with independent approval, restrict "urgent" to a defined payee list, and add the configuration to the quarterly review. Fixing the 11 payments or reminding approvers would not touch this cause.
Test each link: the system configuration export (answer 2), the ticket and its approver (3, 4), the ITGC scope document (5).
Example 2: late month-end close
Condition. The close for four of the six months under review finished after the deadline in the policy.
- Why late? The accounts receivable subledger reconciliation was finished on business day 9 instead of day 5.
- Why? Seventy items were unmatched at the start of the reconciliation.
- Why unmatched? Cash applications from the lockbox file were posting to a suspense account.
- Why? Remittance data from a new customer segment arrived without invoice numbers, and the application rules require an invoice number.
- Why was that not addressed when the segment launched? The process owner for cash application was not part of the launch checklist.
Root cause. The launch process for new customer segments omits the cash application owner. Action. Add that owner to the checklist and define a fallback matching rule. The recurring overtime was the symptom.
Where 5 whys fails
- It follows one line of thought. If the first answer is wrong, everything after it is wrong. Branching and evidence tests limit that.
- It stops at a person. "The clerk made a mistake" is not a root cause. Ask why the process let a mistake through undetected.
- It stops where blame is comfortable. An analysis ending at "insufficient training" with no design flaw identified is unfinished.
- It cannot size anything. It explains cause, not significance. Standard 14.3 requires a separate evaluation of the likelihood and impact of the risk.
When there are many contributing factors, a structured diagram helps. See /us/blog/fishbone-diagram-for-control-deficiency-root-cause-analysis.
Use in financial reporting
For companies subject to SEC rules, root cause matters in the disclosure of a material weakness. The SEC's interpretive guidance says companies should consider disclosure that lets investors understand the cause of the control deficiency and assess its potential impact, and that management should differentiate material weaknesses with a pervasive effect from those without. A well-run root cause analysis supplies exactly that content. See /us/blog/material-weakness-remediation-and-disclosure-in-the-form-10-k.
CPA firms performing quality management work face the same method on their own deficiencies. See /us/blog/sqms-1-root-cause-analysis-of-deficiencies.
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- The IIA, Global Internal Audit Standards (2024), Standards 11.3, 14.3, 14.4 (Requirements and Considerations for Implementation): https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
- SEC, Release No. 33-8810, Section II.B.3, Disclosures about Material Weaknesses: https://www.sec.gov/rules/interp/2007/33-8810.pdf
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error