When an operational risk failure occurs and a loss is sustained, the risk team must look beyond the immediate event to diagnose why the failure happened. Root Cause Analysis (RCA) is a collection of structured diagnostic methodologies designed to trace a failure through its causal chain to identify the underlying systemic weakness that allowed the event to occur.
The 5 Whys Methodology
A linear interrogation technique that repeatedly asks “Why” to trace an effect back to its root cause.
[Operational Event: Unauthorized Client Account Opened]
└── Why? ──► Employee manually bypassed identity verification fields.
└── Why? ──► The core customer onboarding software allowed blank submissions.
└── Why? ──► Validation rules were disabled during an emergency software patch.
└── Why? ──► Code deployment testing protocols were bypassed to meet a deadline.
└── Why? (Root Cause) ──► Management prioritized project delivery speed over risk controls.
The Ishikawa (Fishbone) Diagram Framework
For complex, multi-variable process failures, organizations use the Ishikawa method to categorize potential contributing factors across six core operational areas:
People Risks Process Risks System Risks
│ │ │
├──► Fatigue ├──► Weak QA Check ├──► Code Bug
└──► Lack of Training └──► No Sign-off └──► Server Lag
───┬───────────────────────┬──────────────────────────┬───► SYSTEMIC BREAKDOWN
│ │ │ (CORE DAMAGE LOSS)
├──► Supplier Flaw ├──► Power Drop ├──► Ambiguous Policy
└──► Bad Contract └──► AC Failure └──► No Escalation Path
│ │ │
Third-Party Risks Environmental Risks Governance Risks
By categorizing contributing factors across these dimensions, the organization can target its remediation efforts effectively. Rather than simply disciplining an individual clerk for a processing mistake, the firm can address the underlying system bugs, training gaps, or policy ambiguities that caused the failure, preventing similar events in the future.