Root Cause vs. Symptom

A finding tells us what went wrong.
But that does not always tell us why it went wrong.

Inventory variance.
Late reconciliation.
Missing approval.
Repeated manual adjustment.

These are problems we can see.
But underneath them, there may be something deeper:

Unclear ownership
Responsibility exists, but accountability is not clearly understood.

Poor process design
The process itself creates gaps, unnecessary complexity, or dependency on manual intervention.

System limitations
The system does not adequately support the process or the control objective.

Weak data governance
Data ownership, quality, access, or integrity is not sufficiently controlled.

Misaligned controls
Controls may exist — but they do not address the actual risk.

This is where audit needs to go beyond the symptom.
Because:
“PIC did not follow the procedure” is not always the root cause.

Ask why.
Then ask why again.

Move from the visible exception toward the condition that allowed it to happen.
And continue until we understand not only what caused the problem — but what allows it to keep coming back.

That distinction matters because corrective action built around the symptom may close the finding without materially reducing the underlying risk.

Good corrective action should do more than fix the immediate exception.
It should address the underlying driver and reduce the likelihood of recurrence.

Don’t just fix what happened.
Fix why it keeps happening.

Beyond the numbers. Inside the business.