Podcast: Play in new window | Download (Duration: 14:15 — 13.1MB)
Subscribe: Apple Podcasts | Email | TuneIn | RSS
By Adam Turteltaub
adam.turteltaub@corporatecompliance.org
 brings insight into what root cause analysis is and how to do it properly.){kind=link}
“Root cause analysis” is an oft-used phrase in compliance, but what is it in practice? In this podcast, Leigh Faugust, Counsel at the North American Electric Reliability Corporation (NERC) brings insight into what root cause analysis is and how to do it properly.
She explains that
- Root cause analysis looks at what happened, why it happened and should it have happened
- Getting to the root cause uses iterative digging: asking a “why” question over and over again until you get to something that you can fix
- Generally, five why questions are enough to identify the controls you need to make sure you can get to and fix what went wrong
- One key to success is to put together a team of subject matter experts to help you identify what happened
- Once there is a clear picture of the problem can start figuring out why it happened
- Having a good report writer is essential to help ensure support of the change
- Identifying a problem as human error is really the start, not the end
Listen in and better understand how to get to the roots of your compliance challenges.
An interesting podcast. Thanks for sharing. My takeaway, which I think is important for people to consider when developing their skill set on performing root cause analysis is to identify what are and what is the difference between root cause(s) and contributing cause(s).
For example, in this example, the identification that the person involved has a higher workload than expected would likely be a contributing cause, but not a root case.
I find that doing root cause analysis also known as RCA for impermissible disclosures and such are also very effective ways to not only gauging one’s effectiveness of physical, administrative, and technical safeguards…but also a good way to check compliance with certain requirements (such as for those working with HIPAA…the Security Matrix found in Subpart C).
Many thanks for posting this.
Thank you and great point on the difference between root cause analysis and contributing cause analysis. While “Root Cause Analysis” is certainly a term of art, I often use it in my position to more easily describe the overall process of identifying failures in controls to find areas to mitigate, remediate, and institute preventative controls to address those failures. On the way to a Root Cause, many contributing causes may be found–each of which should signal a need for instituting or correcting an internal control.
Aha…if you are going to also target failures…sometimes an FMEA is the way to go…also a very good tool. (Failure Mode and Effects Analysis)
Thank you for offering this podcast.
In the retail world that I operate, the need to drill down to the roots is imperative and difficult. The speed in which we do business is often a hindrance to being able to spend enough time to truly get to the root cause. This causes the focus on what is more a perception of the cause than the actual cause of the issue.
What I have used over the years is the “hand method” of root cause analysis or the “5-why’s” where one traces their hand and writes the issue in the palm and then starting at the thumb write what the cause of the issue is and then continue to ask why about the previous “finger” and fill in until all 5 fingers are full. This helps simplify the process, but sometimes you may need a couple of “hands” to truly get to the root cause of the issue.
Great discussion.
I agree the “5-whys” is one of my preferred methods for quick cause analysis as well. It is the one I rely on when I need to review a cause analysis to determine if it is adequate. There may be situations where the time required or expense of a deep dive may outweigh the resulting benefit–where addressing the various contributing causes may get you to the same result. That is one place strong internal controls related to identifying and mitigating issues quickly may help. Even if the underlying root cause continues, having controls in place to stop the escalation of an issue once it starts can provide some reassurance.
Good posts.
The 5 or whatever number of whys approach is certainly useful but I think it is also important to point out that it is somewhat limited and in some cases, given its reliance on linear cause and effect relationships that may have more than one cause…can easily lead people down a wrong path.
It is certainly not a bad process…and perhaps one that can help on a basic level.
The important point is not only asking 5 “why” but continue to do so until all your questions are answered and implementing systems and policies to fix the problems(s).
Comments are closed.