An investigation is incomplete if it only identifies individual wrongdoers. The compliance function must perform a thorough Root-Cause Analysis to determine why internal controls failed to prevent or catch the misconduct.
Applying the 5 Whys Model
Investigators use the 5 Whys Model to dig below the surface of an incident and find the underlying systemic weakness. The alphanumeric process works as follows:
Incident: An account manager paid an unapproved commission to a customs broker.
  |- Why 1: The manager bypassed the standard procurement portal.
  |- Why 2: The system allowed manual expense approvals up to $5,000 without a purchase order.
  |- Why 3: Senior management had raised the approval limit to reduce administrative delays.
  |- Why 4: The compliance team was not consulted during the system configuration update.
  |- Why 5: The firm lacked a formal change management policy requiring compliance reviews for IT updates.

By identifying the root cause (the missing IT change management policy), compliance can design a permanent structural fix rather than simply punishing the individual employee.
 
PreviousNext