Root Cause vs. Symptom — Expanded Edition

Root Cause vs. Symptom: Why Internal Audit Must Look Beyond the Finding

Why fixing what went wrong is not the same as fixing why it happened.

An inventory discrepancy is identified. Management performs a stock adjustment. An unauthorized transaction is detected. The employee receives a warning. A reconciliation is overdue. The team completes it. In each case, management has acted. But has the underlying problem been resolved? Not necessarily.

Organizations often confuse correcting a symptom with addressing the cause of failure. An audit finding identifies a condition requiring attention. Root cause analysis investigates why it occurred, which factors contributed, and whether controls allowed it to develop or persist. A finding can be closed administratively while the underlying exposure remains.

Symptom, Immediate Cause, and Root Cause

• Symptom: The observable manifestation of a problem: physical inventory is lower than system records.
• Immediate cause: Goods were released without a corresponding system transaction.
• Contributing factor: Staff used a manual dispatch process during system interruptions.
• Potential root cause: The contingency process lacked clear authorization, subsequent reconciliation, and exception monitoring.

This is an illustrative scenario, not an actual documented audit finding. The potential root cause must be tested against evidence. Multiple underlying causes may exist.

A stock adjustment corrects the recorded balance. Posting missing transactions corrects processing exceptions. Strengthening a deficient contingency control, where supported by the evidence, reduces recurrence risk. These actions serve different purposes.

Why Auditors Stop at Symptoms

Individual error is not always the complete explanation. Auditors should evaluate whether instructions, access, supervision, and monitoring were adequate while preserving accountability for misconduct or negligence.

Management's first explanation is a hypothesis, not proof. “Human error,” “lack of communication,” and “insufficient supervision” require corroboration.

Recommendations should follow causal analysis. Training, reminders, and SOP revisions may help, but they cannot substitute for diagnosing the failure mechanism.

Five Practical Questions

1. What happened? Establish the condition using transactions, system logs, documents, observations, and interviews.
2. What allowed it? Identify immediate and contributing causes.
3. Which control should have prevented or detected it? Assess design and operation.
4. Why did the control fail or not exist? Investigate accountability, workflows, system limitations, incentives, resources, and monitoring.
5. What reduces recurrence? Develop proportionate actions, owners, evidence of implementation, and follow-up measures.

The 5 Whys and fishbone diagrams are optional analytical aids, not mandatory IIA techniques. They do not guarantee a single definitive root cause.

Corrective Action vs. Sustainable Improvement

Symptom-focused: “Remind warehouse employees to record all goods movements accurately.” This may improve awareness, but relies on individual compliance and may leave a control gap unresolved.

Cause-focused: “Establish an authorized contingency dispatch process, require subsequent transaction reconciliation, and monitor unresolved exceptions.” If the diagnosis is validated, this targets the process failure and creates a detection mechanism.

The second action is not automatically superior in every circumstance. Effectiveness depends on causal evidence, proportionality, and proper implementation.

Governance and Follow-Up

Effective root cause analysis helps management and the board distinguish isolated events from recurring operational weaknesses, control design deficiencies, and broader governance problems. Management remains responsible for corrective actions; internal audit evaluates responses and follows up while maintaining independence.

A closed finding does not prove that risk has been resolved. Where appropriate, auditors should obtain implementation evidence and assess subsequent control effectiveness.

Great internal audit goes beyond documenting what went wrong. It helps organizations understand why it happened and how to prevent recurrence.

Beyond the numbers. Inside the business.