Incorporating Root Cause Analysis into an Audit Methodology and work programmes

Building on the one-day introduction to RCA, and practical application courses, this course helps guide audit managers and heads of audit how RCA methodologies can be written and blended with Internal Audit Methodologies and work programmes; and the importance of not regarding RCA as a bolt on.

Who should attend?
Audit Managers, Audit Quality leads and Heads of Internal Audit 

What will I learn?
Recap of RCA fundamentals: A) The difference between immediate, contributing and root causes, B) Why there can be no such thing as one root cause, C) How to address the question of blame (using the Just Culture framework).
Practical guidance how RCA needs to be incorporated into the IA methodology and work programmes. Specific points covered:

• When scoping an assignment, how thinking about causes requires us to think carefully about what is in/out of scope. For examples, when should an assignment look across departments (to consider a whole risk/process) or between first line and second line functions (to pin down roles and accountabilities etc.)
• When developing work programmes, what are the key ingredients and expected controls that will test whether causal factors have been examined (which might point to the causes of any issues or exceptions BEFORE these are found). 
• How RCA can support data mining and data analytics – with smart hypotheses. 
• When writing up findings, how might these be combined; allowing 10 issues/exceptions to be explained through four key causes. 
• When reporting to senior management and the board, how to distinguish between WHAT has been found and the themes that explain WHY these problems have occurred. 
• When you approach RCA this way you will discover, contrary to urban myths, that RCA can speed by audit assignments – as explained in the “Lean Auditing” book. It also highlights how the audit planning process should leverage insights from RCA work (as required at GIAS 9.3); It may identify ways in which audit ratings, action planning and follow-up processes might be improved. 

CPE competency areas covered

• Performance (Organisational governance | Risk management | Internal control | Engagements
• Environment (Organisational strategic planning and management)