Forward Thinking

Root cause analysis (RCA) has traditionally been viewed as an assessment method most appropriately used following a major risk event or loss. Increasingly, though, savvy risk managers with more mature risk management programs are using the same techniques to support business and strategic planning as a means of proactively managing risks before they can affect planned objectives.

What is root cause analysis?

Root cause analysis (RCA) refers to a series of techniques and approaches designed to allow practitioners to identify the underlying cause or driver of risks. A significant number of the techniques were originally developed in the process engineering and safety fields. These techniques were intended to not only identify potential safety hazards and points of failure during the design of new engineering processes, but also to determine why risk events occurred following significant losses. While it is beyond the scope of this article to address all of the techniques or explain them in detail, risk professionals would benefit from learning about them.

The use of RCA has typically been associated with reactive, rearwards-looking review situations. Typically, a significant loss event will have occurred (such as a process failure leading to damage, loss or injury) or a planned activity will not have achieved its expected outcomes.

In this type of application, various techniques will be used to try and identify what failure mode gave rise to the loss event, with this information used to support recovery or future preventive actions.

Applying root cause techniques

In more straightforward cases, this might simply use what is known as the five whys approach of RCA. The problem can be analyzed sequentially by asking “why” a factor contributed to the loss event until no further explanation can be found. In more complex cases, this approach may be nested inside a cause and effect analysis (sometimes called Ishikawa or fishbone) diagram. The use of cause and effect diagrams support the analysis of more complex situations, particularly where there are multiple drivers of risk present, each of which requires a more detailed analysis in order to develop a comprehensive picture of the situation.

These same techniques can also be used to identify the potential sources of risk during business or strategic planning processes. By developing a picture of the potential risks associated with a planned activity, initiative or objective, planners are able to better incorporate risk treatment activities right up front, rather than as an “add-on” after the fact.

When used proactively, the focus of the analysis shifts from the question of what caused a loss to happen to what could cause something to fail – or, perhaps more important – what will cause something to succeed. This type of analysis can also include a range of other RCA techniques such as force field analysis (designed to identify driving and restraining forces in the environment) and influence diagramming, which is designed to pictorially show how the relative strengths of the risk or source inter-dependencies can impact each other. Both force field analysis and influence diagrams allow the experienced user to align specific actions with specific risks (or people) as a means of leveraging (or overcoming) existing dependencies.

The proactive application of RCA techniques can be problematic in some situations, particularly where there is cultural skepticism about the value of future casting. One method of overcoming this skepticism is by conducting a solutions effect analysis following the use of other RCA techniques. This approach is similar to the cause and effect technique, but sees the proposed “answers” grouped thematically rather than the risks. These solutions are then analyzed again to reveal any unintended consequences – or untapped success levers – resulting from the combination of proposed actions.

By including the proposed solution or action owners in this process, they are often able to see where their ideas may need refinement, as well as giving them greater confidence that the process used to get to those answers was robust.

Other extensively used approaches to root causes analysis include concept fans, hazard and interoperability studies, solution effects analysis, life cycle value analysis and hazard identification/environmental identification. While this list is not exhaustive, it provides a good starting point for risk managers looking for a deeper understanding of their exposures. 

Selling Root Cause Analysis

Root cause analysis, when done in a comprehensive and planned manner, provides organizations with the opportunity to not only fully understand the causes of their past losses, but also to proactively plan to prevent similar losses in the future. When used to identify the true cause of past losses, the use of RCA techniques enables organizations to identify, and then treat the “disease” rather than simply applying a temporary Band-Aid solution to the “symptoms.” In doing so, most organizations will find that their total cost of risk is reduced, as they are no longer required to repeatedly address the same problem.

Equally, by applying RCA techniques to the analysis of proposed actions, initiatives and objectives while they are still in the planning phase, organizations are typically able to improve those solutions through the integration of effective risk controls from the outset. This tends to not only improve the effectiveness of the solutions themselves, but also helps to prevent the need (and cost) associated with adding additional layers of risk control after implementation. This helps to reduce costs further, as post-implementation application is often less effective, and is sometimes too late to save a promising opportunity from failure. 

Conclusion

A root cause discipline is a key attribute or competency for mature enterprise risk management programs, as highlighted in the RIMS Risk Maturity Model. Employing root cause analyses in a predictive way for future initiatives, in addition to conventional post-action assessments, facilitates actions that remove, exploit or mitigate the uncertainties associated with those initiatives.

Organizations can improve the odds of successful future outcomes by applying risk controls – and previously unrecognized success levers – that most effectively deal with “bottom- line” sources of risk. In doing so, they reduce their overall cost of risk by reactively and proactively addressing the root causes of their risk exposures.