Abstract

     The objective of this study is to increase understanding of internal auditor use of root cause analysis (RCA). The IIA’s Practice Advisory 2320–۲: Root Cause Analysis (IIA 2011) states that RCA should be a core competency for internal auditors to provide insight and add value within organizations. However, little is known about internal auditor use of RCA in a profession where normative problem-solving theory and RCA frameworks potentially conflict with professional demands for independence and objectivity. We conduct in-depth interviews with 21 high-level internal auditors with RCA experience to understand use within the profession. The results suggest several overarching themes that have implications for policymakers, researchers, and practitioners. First, we find that internal auditors in practice believe that RCA is a very important tool within the profession. Second, although internal auditors generally claim to understand RCA, we find considerable variation in the ways they approach the construct and implement prescribed processes in practice. Finally, the results indicate that while RCA use is reasonably prevalent among internal auditors, knowledge constraints, resource limitations, and concern about independence and objectivity create considerable variation in terms of RCA approach, rigor, and efficacy within organizations.

Introduction

     Internal auditors serve an evolving variety of assurance and consulting roles within organizations that require a diverse skillset to add value within organizations.1 Policymakers have established internal auditor performance of root cause analysis (RCA) as a key skill within the profession. Wilson, Dell, and Anderson (1993) define RCA in a problem-solving context as a process of identifying the most basic reason for an undesirable condition or problem that, if corrected or eliminated, would have prevented it from existing or occurring. The Institute of Internal Auditor’s (IIA) Practice Advisory 2320–۲: Root Cause Analysis (IIA 2011) states that “a core competency necessary for delivering insights is the ability to identify the need for root cause analysis and, as appropriate, actually facilitate, review, and/or conduct a root cause(s) analysis” (para. 2). However, the literature provides evidence that internal auditors sometimes fail to fulfill expectations in the area. For example, Miller and Smith (2011) provide evidence of a gap between what is expected from internal auditors related to RCA use and what they actually provide. After an investigation of fraudulent sales practices at Wells Fargo, the board of directors concluded that internal auditors had access to information regarding sales practice problems, but “did not attempt to determine the root causes of unethical sales practices” (Wells Fargo 2017p. 91).

     The objective of this study is to evaluate internal auditor use of RCA in the profession as called for by policymakers. This research is motivated in large part by the lack research on RCA use by internal auditors and the factors that affect their performance in the area given various and sometimes conflicting professional calls for independence, objectivity, professional skepticism, and due care. In an internal audit context, extant studies focus on internal audit quality (e.g., criteria and perceptions) and roles in organizational governance (Gramling et al., 2004, Roussy and Perron, 2018). For example, Barua, Rama, and Sharma (2010) discuss how internal auditors can assist audit committees by providing independent investigations and evaluation of accounting practices, processes, and controls. However, extant research provides little insight into internal audit practice. Roussy and Perron (2018) provide a structured literature review with 91 internal audit studies from 2005 to 2017 and find that “only 13 of these papers addressed internal audit practice and…scholars know very little about how internal auditors behave” (p. 373).

Discussion and conclusion

     The IIA prioritizes RCA for internal auditors as a core competency that should help them add insight and value within organizations. Although policymakers prescribe the importance of RCA in the profession, the literature lacks evidence about internal auditor use of RCA in an environment with professional (e.g., independence, objectivity) and practical (e.g., time, expertise, access) constraints. We use in-depth interviews with highly experienced internal auditors to provide initial evidence about RCA use within the profession.

     Table 2 provides a summary of key takeaways and specific questions for future research. Several primary themes deserve careful and continued consideration. First, we find strong agreement that RCA is an important tool for internal auditors working to solve problems and add value within their organizations. Reported keys to RCA success include obtaining a thorough understanding of business processes and having frequent group discussions to challenge findings and potential solutions. However, the interviewees also emphasize that internal auditors should carefully consider resource constraints and prioritize RCA efforts in high-risk areas where it can have the greatest impact. Second, although the interviewees generally claim to understand RCA, we find evidence of a substantial knowledge gap between what they think RCA is and what it actually is given prescriptive and practice guidance in the area. For example, some interviewees view RCA simply as a general mindset and lack awareness of professional guidance, training opportunities, and rigorous methods available to them and their colleagues. Finally, although internal auditor use of RCA appears to be reasonably prevalent, the knowledge gap, resource constraints, turnover issues, and professional concerns about independence create considerable variation RCA approach, rigor, and efficacy. Although some internal audit leaders clearly manage sophisticated RCA systems that triangulate methods and include rigorous data collection, analysis, and documentation procedures, others readily admit they lack the resources and expertise to perform RCA as called for by policymakers.