Root cause analysis is usually requested because fixing an outcome is not enough, and a firm is expected to explain why an issue occurred and whether the same issue could happen again.
If you have been asked to carry out a root cause analysis and are unsure what is expected, that uncertainty is common, as regulatory guidance explains why root cause analysis matters but rarely explains how it should be carried out in practice.
This article explains what a root cause analysis is expected to show, why it is requested, how it should be approached, and when specialist support may be appropriate.
Why is root cause analysis requested?
Root cause analysis is requested where there is concern that an issue reflects more than a one-off error, because whilst rectifying an internal error or an upheld complaint resolves the position, it does not explain whether the failure that led to it could affect others or point to a wider weakness.
It is therefore used to test whether the firm understands what went wrong at a process level rather than only at the level of an individual case.
Common triggers for root cause analysis
While a formal request often follows a customer complaint, root cause analysis is equally valuable for identifying internal systemic failures that may not have reached an external stakeholder yet. Triggers for an analysis often include:
- Financial Discrepancies: Investigating “missing money,” unexplained budget variances, or reconciliation failures.
- Operational Errors: Identifying why “wrong orders” are being processed or why stock levels are inaccurate.
- Systemic Near-Misses: Analysing errors that were caught internally but could have resulted in significant loss or regulatory breach if they had reached the customer.
- Process Inefficiencies: Looking into why specific tasks require constant manual intervention or workarounds.
What a root cause analysis is expected to show
A root cause analysis is expected to explain what failed, why it failed, and what has changed as a result, but this is not a narrative exercise, and each part needs to be supported by evidence:
- What failed: This should be set out factually using records rather than interpretation.
- Why it failed: The analysis should trace the issue back through the process rather than stopping at the visible error.
- What has changed: This should show how the action taken reduces the risk of the same issue occurring again.
If any of these elements are unclear, the analysis is likely to be challenged.
Starting the analysis
A root cause analysis should begin with a clear description of the failure, including where it occurred in the process and what the consequence was for the customer, before any attempt is made to explain it.
If the issue is described too broadly, the analysis will lose focus, and if it is framed as an explanation rather than a failure, it will usually confirm the conclusion instead of testing it.
Separating the facts
What happened and why it happened should be treated as separate stages of the root cause analysis, because if you create explanations too early can often reflect convenience rather than the cause.
What happened should be recorded first using evidence such as case files, complaint records, or system data, with the explanation considered only once the facts have been identified.
Identifying the cause
The cause of an issue is rarely the point at which the problem became visible, as an individual error may explain what happened without ever explaining why or how it was possible. The analysis should therefore consider how the process was designed, how it was meant to operate, and where it did not operate as intended, which is where root cause analysis shifts from case handling to risk management.
Assessing whether the issue could happen again
Root cause analysis should assess whether the same failure could reasonably occur in future cases by reviewing whether similar issues appear elsewhere in complaints data, monitoring activity, or internal reviews.
Where the same type of failure appears in different areas, this usually indicates a shared underlying cause, and treating cases in isolation limits the value of the analysis.
Deciding what action is needed
Any action identified should follow directly from the cause identified, as actions that are not clearly linked to the cause are difficult to defend and rarely prevent recurrence.
If the cause relates to unclear guidance, system limitations, or weak controls, the action should address that specific issue rather than defaulting to generic reviews.
Can root cause analysis be carried out internally
Many firms can carry out root cause analysis internally where the issue is narrow and the cause is clear, but difficulties arise where issues span multiple teams, involve historic decisions, or rely on interpretation rather than evidence. Internal analysis may also reflect how the firm views its own processes rather than how those processes appear when reviewed externally, which can limit its strength.
How ALPH Legal & Compliance can help you conduct Root Cause Analysis
Specialist support is most valuable where firms need to demonstrate that their analysis is robust, objective, and aligned with regulatory expectations.
At ALPH Legal & Compliance, we support firms by reviewing root cause analysis, challenging conclusions where evidence is weak, and helping structure the reasoning so it can be followed and defended without removing internal ownership.
Speak to our team today to get guidance and support for your root cause analysis.