Root cause identification
Identifying the root cause of any set of risks means that those causes,
no matter how ingrained in an organization, can be recognized as
separate and distinct causes of risk. ey are the drivers and the con-
tributory factors for making risk events come to pass. e key to root
cause identication is to nd those causes that are truly at the heart
of driving risk. Root cause identication and analysis does not seek to
discover what may occur or how it may occur. Instead, the emphasis
is on why a given set of risks may occur (and as a result, it should be
able to address that why in terms of ensuring that it is recognized and
Similar to risk identication, root cause identication and analysis is
an exercise in exploration. It is a shared quest for the causes behind
risk. Rather than trying to understand the nature of a given risk event
and/or its potential impact, root cause identication and analysis
examines the nature of why risks are happening (or may happen) and
what can be done to alter the environment to minimize or eliminate
Root cause identication and analysis is applied when direct action
to resolve a risk seems inappropriate, unwieldy, or temporary. By way
of example, shooing away a rabbit may temporarily eliminate the risk
that a vegetable garden will be eaten, but it does not address the root
cause. Root cause identication and analysis would instead address
why rabbits are in the garden in the rst place or why the food supply
for rabbits is suciently decient elsewhere that the garden seems
an attractive option. Root cause identication and analysis examines
causal factors to create a proactive shield around a particular subset of
risks and can be appropriate when there are sucient answers to the
question of why risks may occur.
Inputs and Outputs
Inputs into root cause identication and analysis are data. ose data
include more than just the risk events under consideration. ey are
also lists of answers to the “why” question. For the garden example,
the questions would represent an eort to backtrack and try to deter-
mine some of the causes.
e data include not only a host of potential impacts from the risk
events but also myriad factors that may be causing them.
Outputs from root cause identication and analysis will include
specic causal factors that may be responsible for enabling or increas-
ing the probability (or impact) of single or multiple risk events.
Outputs often take the form of a causal factors chart. A causal factors
chart starts with the potential problem on the top or right, breaking
down the causes to the bottom or left until the root causes are identi-
ed (as illustrated in Figure 16.1).
ose root causes may be converted into a checklist format to deter-
mine whether they are present or prevalent within a given project. e
Site is not
Figure 16.1 Sample causal factors chart.