Root cause analysis (RCA) – a key element of ISQM 1 – has become an increasingly important tool in firms' efforts to improve or maintain audit quality. But are we spending too much time finding causes and not enough time deciding what to do about them?
At ICAEW's Audit and Assurance Conference in June, Jonathan Batchelor, CEO of RCA software and training company What Caused This, delivered a thought-provoking session exploring this challenge and questioning whether organisations sometimes mistake cause identification for improvement itself.
Here, Jonathan explores these themes further, arguing that the real value of RCA lies not in understanding what went wrong, but in deciding where to focus improvement efforts to achieve better outcomes.
Why identifying causes and improving quality are not the same thing
RCA has become an increasingly established part of the audit quality process over the last decade – both before and after its formal introduction in the requirements of ISQM 1.
Firms have invested significant time and effort into developing methodologies, training teams and improving consistency in how findings are analysed. As a result, many organisations are now considerably better at gathering evidence, identifying contributory factors and understanding why issues occurred.
We can become so focused on finding causes that we forget why we were looking for them in the first place.
This is undoubtedly a positive development. However, as RCA processes mature, another risk can emerge. We can become so focused on finding causes that we forget why we were looking for them in the first place.
Cause maps become more detailed.
Categories become more refined.
Analysis becomes more thorough.
All of this creates value. But the objective was never simply to identify causes. The objective was to improve outcomes.
The risk of treating cause identification as success
One of our observations across multiple industries is that organisations often become very effective at understanding what happened.
A finding is identified > an RCA is conducted > causes are documented > the process is completed.
Yet improvement does not happen when causes are identified. Improvement happens when organisations decide which causes are worth acting upon and then ensuring those actions are effective.
This distinction matters because identifying causes feels tangible. An RCA can be completed. A report can be finalised. A root cause can be documented.
Improvement is less straightforward. It requires prioritisation, ownership, implementation and follow-up. These activities often extend well beyond the RCA itself and involve decisions about resources, timing and risk. As a result, organisations can sometimes become more focused on completing the analysis than delivering the improvement.
Not all causes serve the same purpose
One of the challenges with RCA is that a single event rarely has a single cause. Whether the discussion relates to audit quality, or outside of audit – patient safety, operational resilience or service delivery – analysis often identifies a combination of immediate, contributory and systemic causes.
The challenge is not determining whether those causes are valid, it is in deciding which causes are most likely to deliver meaningful improvement if addressed.
- Some causes help us understand.
- Some causes help us manage risk.
- Some causes help us improve outcomes.
These are not always the same thing. A cause can be accurate and still be of limited value from an improvement perspective. Recognising a factor that contributed to an outcome is important. Deciding whether acting on that factor is the best use of organisational effort is a different question entirely. This is where judgement becomes critical.
The best cause to address is not always the deepest cause
There is often an assumption that the deepest cause is automatically the most important. In practice, this is not always true. Some causes sit outside an organisation’s immediate control, or require significant investment and long-term change. Others may genuinely explain an outcome but offer limited opportunity for practical improvement in the near term. Others still may be more visible, more manageable and more directly linked to actions that can strengthen performance.
This does not make them less important, and indeed in many cases, it makes them more useful. The causes that generate the greatest improvement are not necessarily those furthest down a cause-and-effect chain. They are often the causes that sit at the intersection of influence, practicality and impact.
The objective is not to find the most causes, nor is it to find the deepest cause. The objective is to improve audit quality.
From understanding to improvement
The purpose of RCA is not simply to explain the past. It is to support better decisions about the future. An effective RCA process therefore goes beyond identifying causes. It creates visibility of the causes that matter most, supports prioritisation and enables actions to be linked directly to the issues they are intended to address.
Ownership, monitoring and effectiveness reviews then become just as important as the analysis itself. Without these steps, even a well-executed RCA risks becoming an exercise in understanding rather than improvement. The strongest RCA processes do not end with a report, they continue through implementation, review and validation. And they ask whether the action was completed, whether it delivered the intended outcome and whether quality improved as a result.
Looking ahead
The profession has made significant progress in its ability to identify causes. The next challenge may be different. Rather than getting better at finding causes, we may need to become better at deciding which causes are worth acting upon.
This is where RCA can make its greatest contribution to audit quality. Not by generating longer lists of causes, but by helping firms make better decisions about where to focus their improvement efforts.
Because finding the root cause is not the finish line.
It is the halfway point.
Jonathan Batchelor, CEO, What Caused This
