A single chain of questions can miss causes that sit in a different part of the process. A fishbone diagram lays out candidate causes by category around one stated effect, so a team can see the whole field before testing any of it. IIA Standard 14.3 requires auditors to collaborate with management to identify root causes when possible, and its implementation text describes the root cause as an underlying or deeper issue than the direct reason a condition exists. The fishbone is one disciplined way to organize that collaboration. It is not prescribed by any standard, so treat it as a working technique and document the evidence behind whatever it points to.
When to use a fishbone and when to use 5 whys
| Situation | Better tool |
|---|---|
| One failed control with an obvious chain of events | 5 whys |
| A finding with several possible contributors across people, system and policy | Fishbone, then 5 whys on each supported branch |
| A theme across several engagements | Fishbone on the theme as the effect |
See /us/blog/5-whys-root-cause-analysis-for-control-failures for the questioning method.
Build the diagram
- Write the effect as the head of the fish. One precise sentence with a number and period.
- Choose the category bones. For finance and control problems, a workable set is: People, Process, Systems and data, Policy and design, Oversight and monitoring, and External factors. Use categories that fit the problem, and drop empty ones.
- Brainstorm causes under each bone. Include the people who operate the process. The implementation text notes management may be better positioned to understand underlying causes.
- Mark each cause as tested, untested or rejected. A cause enters the finding only if evidence supports it.
- Select the root causes. Choose the ones that, if fixed, would have prevented the condition, and run 5 whys on them for depth.
Worked example
Effect. Duplicate payments totaling $96,300 across 17 invoice pairs in the 12 months under review.
| Bone | Candidate causes | Evidence | Status |
|---|---|---|---|
| People | Temporary staff creating vendor records without searching for an existing one | Creation log: the 7 second records were all set up within two weeks of a month-end close | Tested: contributing |
| People | Clerks ignoring the system's duplicate warning | System log: warning overridden on 3 of the 17 pairs | Tested: contributing |
| People | Clerks unaware of the duplicate report | Interviews: all four clerks knew of it | Rejected |
| Process | Same invoice submitted by email and through the vendor portal | AP mailbox and portal logs show 5 of the 17 pairs received through two channels | Tested: contributing |
| Process | Weekly exception report review not documented for 27 of 52 weeks | Report folder; no signed copies | Tested: contributing |
| Systems and data | Duplicate check runs within one vendor ID, so a second record for the same vendor bypasses it | System configuration; rerunning the match on tax ID finds 11 of the 17 pairs | Tested: root cause |
| Systems and data | Vendor master holds two active records for the same vendor | Vendor list: 7 vendors with two active records, covering the same 11 pairs | Tested: contributing |
| Policy and design | Vendor setup procedure has no duplicate search step and no periodic clean-up | Vendor procedure 6.1 | Tested: contributing |
| Oversight | No metric on duplicates recovered | Controller's dashboard | Untested |
| External | Vendor billing practices | Not supported by the data | Rejected |
Reading the diagram, the fix has three parts: scope the system's duplicate check across vendor records by tax ID, merge the duplicate vendor records, and add a duplicate search step to vendor setup with a periodic clean-up. The untested oversight cause stays on the list for follow-up. The finding follows the Standard 14.3 template elements: criteria, condition, root cause, effect, and significance and prioritization. The fishbone belongs in the workpapers as support.
Rules that keep the diagram honest
- Keep it to one effect. Mixing effects creates a sprawling diagram with no answer.
- Do not use the diagram as evidence. It is a map of hypotheses. The evidence column is what the file relies on, and Standard 14.1 requires gathered information to be relevant, reliable and sufficient.
- Do not stop at the people bone. A cause that names a person without a design weakness behind it is unfinished.
- Time-box the brainstorm. Set a fixed time limit and hold it with the process owners in the room. Open-ended sessions drift.
- Record who contributed. The Standard 14.3 requirement to collaborate with management is easier to demonstrate with a list.
Using the output
The selected root causes drive the recommendation (Standard 14.4 lists addressing the root cause among the purposes of recommendations or action plans) and the follow-up test (Standard 15.2). For the duplicate payment example, follow-up reruns the tax ID match over the full population of payments made after the change. Themes across engagements, such as repeated weaknesses in configuration management, must be communicated timely to the board and senior management under Standard 11.3.
Financial reporting context
When a control deficiency may be a material weakness, the evaluation under SEC guidance considers whether there is a reasonable possibility that controls will fail to prevent or detect a misstatement and the magnitude of the potential misstatement. Root cause determines whether multiple deficiencies are really one underlying weakness that affects the same financial statement amount. The SEC guidance says deficiencies that affect the same amount or disclosure may, in combination, constitute a material weakness even if each is less severe on its own. A fishbone that shows three of five branches converging on the same system setting supports that aggregation analysis. See /us/blog/control-deficiency-aggregation-memo-sec-guidance-and-written-conclusion.
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- The IIA, Global Internal Audit Standards (2024), Standards 11.3, 14.1, 14.3, 14.4, 15.2: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
- SEC, Release No. 33-8810, Section II.B.1, Evaluation of Control Deficiencies: https://www.sec.gov/rules/interp/2007/33-8810.pdf
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error