“Until you find the root, the weed will return.” — African Proverb
In audit rooms across the continent, findings are documented, reported, and sometimes even acted upon. Yet the same issues resurface—quarter after quarter, year after year.
Why?
Because too often, internal audit stops at the symptom and fails to dig into the system.
At AfriAudit, we believe audit should not just highlight what failed—but explain why it failed. And that’s where Root Cause Analysis (RCA) becomes more than a method. It becomes a mindset.
Inside This Edition:
- Why surface-level findings sabotage audit value
- The difference between treating issues and transforming systems
- Four practical tools to apply RCA in audit fieldwork
- How RCA builds trust with management and drives real change
The Problem: Reporting the Obvious, Missing the Opportunity
Let’s face it—too many audit reports are stuck on repeat:
- “Approvals were missing.”
- “Policies were not followed.”
- “There was no segregation of duties.”
These findings, while accurate, are diagnoses without depth. They describe the failure, not the force behind it.
Management already knows what happened.
What they’re looking for is: Why did it happen? And how do we prevent it from happening again?
Without root cause clarity, corrective actions become cosmetic. Symptoms are treated, but systems remain unchanged.
The Auditor’s Real Mandate: Move from Fault-Finding to System-Finding
Root Cause Analysis shifts the internal auditor from an inspector to a system thinker—someone who can:
- Uncover patterns behind the problems
- Identify the human, process, and cultural drivers of failure
- Frame findings in a way that leads to transformational fixes, not transactional patches
The Four Layers of Root Cause Thinking
Effective RCA in audit requires peeling back the layers. Here’s how we think about it at AfriAudit:
- Event — What happened? E.g., “Supplier paid twice for the same invoice.”
- Error — What went wrong in the process? E.g., “The system didn’t flag the duplicate.”
- Cause — Why did the error happen? E.g., “Staff bypassed the system due to time pressure.”
- Systemic Root — What in the structure, culture, or strategy allowed this? E.g., “Incentives favor speed over accuracy; control overrides are normalized.”
This depth of thinking helps audit deliver real value to the C-suite—not just fixes, but foresight.
Tools for Root Cause Analysis in Internal Audit
Internal audit teams can apply proven tools to uncover deeper causes:
- The 5 Whys: Keep asking “why” until you get beyond the technical answer to the systemic cause.
- Fishbone (Ishikawa) Diagrams: Map out potential drivers of an issue—people, process, environment, systems, culture.
- Process Mapping: Visualize where breakdowns happen and where accountability blurs.
- Control Culture Interviews: Engage stakeholders not just on what failed, but on how they experience risk in real time.
The Payoff: Action That Sticks
When audit findings include root cause insights, they do more than get noticed—they get adopted.
Why? Because:
- They make the risk feel real
- They resonate with executive priorities
- They lead to solutions that solve for today and safeguard tomorrow
Building RCA into the Audit Lifecycle
Root cause thinking should start before fieldwork and continue through to reporting:
- Planning: Ask if this area has a history of repeat issues. Why?
- Testing: Don’t just document what failed—observe how people work around the system.
- Reporting: Highlight both the failure and the underlying friction that made it possible.
- Follow-Up: Track not just if actions were implemented, but if the system has changed.
The AfriAudit View
At AfriAudit, we see Root Cause Analysis not as a tool, but as a professional philosophy.
We share insights with audit teams across Africa to:
- Embed RCA into audit methodology
- Coach auditors on root cause interviewing and synthesis
- Align root cause thinking with enterprise risk and strategy
Because when audit stops at symptoms, it gets ignored.
When it targets root causes, it gets trusted.
A Final Word to the Internal Auditor
Every audit finding is a clue. But it’s up to you to solve the case.
The next time you write “Policy not followed,” stop and ask:
- Why not?
- What made non-compliance easier than compliance?
- Is this a failure of people, or the process, or the system they operate in?
Find the cause, not just the flaw.
Because great auditors don’t just detect risk—they disarm it at the source.
Let’s audit deeper. Let’s audit wiser.
Let’s audit forward.
Our Commitment at AfriAudit
AfriAudit is more than a newsletter.
It’s a movement — to restore trust in audit, reposition the profession as a strategic partner, and help Africa’s leaders make clarity-driven, principled decisions.
We believe that when audit works, trust thrives.
Let’s Build This Together
Are you a CEO, board member, auditor, or policymaker committed to principled leadership?
Let’s elevate the internal audit profession across Africa. Let’s unlock its full potential as a lever for transformation and trust.
Follow AfriAudit
Comment below
Subscribe for future insights
With clarity and commitment,
Titus Wambua
Chief Audit Executive | Governance Advisor | Founder, AfriAudit
Turning audit into a boardroom asset — one institution at a time.
