When compliance officers, internal auditors, and risk managers discover an issue like a control failure or policy violation, questions arise. You're in containment mode, senior leadership wants answers, and someone inevitably asks: "Do we need a root cause analysis?" Confusion often follows about scope, ownership, documentation, and when "good enough" becomes a liability.
Here's what you need to know when RCA becomes urgent.
Do We Need an RCA for Every Compliance Incident?
Not every incident requires an RCA, and mandating one for every issue can create its own risks.
The DOJ's corporate enforcement policy requires a "thorough analysis of the causes of underlying conduct" for credit in remediation. However, not every minor issue, like a password reset, needs full analysis.
Use a risk-based threshold. Ask: How likely is this issue to reflect a broader problem? What are the potential consequences?
Consider recurrence (could it happen again?), read-across (could it exist elsewhere?), and look-back (has it happened before undetected?). Impact includes regulatory exposure, financial harm, and reputational damage.
Some teams score these factors against risk appetite. A low score might mean immediate corrective action with documentation. A moderate score triggers a limited RCA. A high score requires formal analysis with oversight.
Document your decision. A brief record showing you considered the factors protects you from hindsight bias later.
Who Owns the RCA When Multiple Teams Are Involved?
Ambiguity in ownership causes more delays than the analysis itself.
Legal, compliance, internal audit, HR, finance, and the business all have stakes. Identify who decides if an RCA is needed, who leads it, who approves conclusions, and who owns corrective action.
Typically, compliance or internal audit leads, with legal managing privilege protocols. The business owns corrective action implementation. Finance or risk may handle testing and validation.
Define workstream ownership early. If running an RCA parallel to an investigation, establish interview sequencing and privilege protocols. Avoid multiple narratives with no clear remediation path.
What Questions Should We Ask During an RCA?
Go beyond symptoms. "The employee violated the policy" isn't a root cause.
Ask what incentives or pressures contributed. What weaknesses in controls, supervision, training, or culture allowed the issue? Was it isolated or systemic? Could it exist elsewhere or have occurred before? Were warning signs missed?
Consider Wells Fargo's case between 2002 and 2016. The bank treated individual termination as a solution without a root cause analysis until 2017, leading to a $3 billion settlement.
Your output should identify the issue, scope, root causes, limitations, and recommended next steps. Details should scale with the issue's seriousness and the confidence management needs.
How Do We Know When We've Gone Deep Enough?
You've gone deep enough when you can answer: What risk remains after correcting the incident?
That remaining risk determines your response. Lower risk might call for documentation and monitoring. Moderate risk might need targeted corrective action or control redesign. Systemic risk might require independent testing or governance changes.
Scope should match the risk and remain adjustable. Some issues, like fraud or significant harm, warrant an RCA regardless of scoring.
Do We Need to Test Whether Our Corrective Action Worked?
Testing confirms the cause was addressed.
Ask: What evidence shows the condition that allowed the problem changed? Lower-risk issues might need owner certification or monitoring. Systemic issues might require sampling, analytics, or independent validation.
Your guidance should require management to decide on testing necessity, evidence sufficiency, testing responsibility, timing, and exception handling.
Read-across work may reveal broader weaknesses. If the same control gap appears in multiple units, expand your response accordingly.
What Should We Document If We Decide NOT to Do a Full RCA?
If you decide against a full RCA, document your decision.
A concise record should identify the issue, factors considered, rationale for the RCA level, immediate corrective action, and circumstances for reconsideration. This guards against hindsight and shows you made a reasoned decision.
Where Should We Start If We Don't Have RCA Guidance Yet?
Start with practical written guidance on when to consider RCA, how far to go, who should participate, what to document, and how to verify corrective action.
Avoid overpromising. Define minimum expectations, preserve discretion, and require documentation when management departs from ordinary thresholds. Aim for proportionality, not a rigid checklist.
Build the framework now, while you have time to define what "thorough analysis" means for your organization's risk profile. Root Cause Analysis Guidelines
