Root cause identification
and analysis
Identifying the root cause of any set of risks means that those causes,
no matter how ingrained in an organization, can be recognized as
separate and distinct causes of risk. ey are the drivers and the con-
tributory factors for making risk events come to pass. e key to root
cause identication is to nd those causes that are truly at the heart
of driving risk. Root cause identication and analysis does not seek to
discover what may occur or how it may occur. Instead, the emphasis
is on why a given set of risks may occur (and as a result, it should be
able to address that why in terms of ensuring that it is recognized and
dealt with).
Technique Description
Similar to risk identication, root cause identication and analysis is
an exercise in exploration. It is a shared quest for the causes behind
risk. Rather than trying to understand the nature of a given risk event
and/or its potential impact, root cause identication and analysis
examines the nature of why risks are happening (or may happen) and
what can be done to alter the environment to minimize or eliminate
the cause.
When Applicable
Root cause identication and analysis is applied when direct action
to resolve a risk seems inappropriate, unwieldy, or temporary. By way
of example, shooing away a rabbit may temporarily eliminate the risk
that a vegetable garden will be eaten, but it does not address the root
cause. Root cause identication and analysis would instead address
why rabbits are in the garden in the rst place or why the food supply
risk ManageMent
for rabbits is suciently decient elsewhere that the garden seems
an attractive option. Root cause identication and analysis examines
causal factors to create a proactive shield around a particular subset of
risks and can be appropriate when there are sucient answers to the
question of why risks may occur.
Inputs and Outputs
Inputs into root cause identication and analysis are data. ose data
include more than just the risk events under consideration. ey are
also lists of answers to the “why” question. For the garden example,
the questions would represent an eort to backtrack and try to deter-
mine some of the causes.
e data include not only a host of potential impacts from the risk
events but also myriad factors that may be causing them.
Outputs from root cause identication and analysis will include
specic causal factors that may be responsible for enabling or increas-
ing the probability (or impact) of single or multiple risk events.
Outputs often take the form of a causal factors chart. A causal factors
chart starts with the potential problem on the top or right, breaking
down the causes to the bottom or left until the root causes are identi-
ed (as illustrated in Figure 16.1).
ose root causes may be converted into a checklist format to deter-
mine whether they are present or prevalent within a given project. e
stolen from
job site
Site is
difficult to
Site is not
Figure 16.1 Sample causal factors chart.

Get Risk Management, 5th Edition now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.