Risk Management - Root Cause Analysis
When a risk first surfaces, those who have identified it will likely be describing the symptoms and surface issues.   The risk should not be identified at this point as its description might suggest remedies and mitigations that are misdirected and inefficient.  Instead, a root cause analysis must be performed to find the underlying conditions causing the concerns of the team who first identified the risk.   . 

A root cause analysis simply takes all the symptoms and asks the question, “What is causing the cause of these symptoms/conditions?”  The causes identified are recorded.  The question is asked again, “What is causing the causes just identified?”  This process of asking and answering the same question repeatedly will ultimately lead to one of the two answers: 1) insufficient resources (funding or time) or 2) poor management.  The remedy to the these two are either more resources or new management and are seldom options open to the risk management team. 

Since both resources and management are often constraints to the project, the root cause becomes the answers just prior to the arrival of these constraints.  With the identification of the root causes, resolving the risk is simply the removal of the root causes.  

 4.5.1 Root Cause Analysis

Often, a risk is identified by someone who only observes the symptoms.  The purposes of a root cause analysis is to investigate the causes at a deeper level as to reveal the underlying source.  At this point, the risk is most effectively and efficiently resolved simply by finding ways to remove the root causes.  Thus, as new risks are proposed by the team members who are executing the implementation plan (doing the work), these risks are investigated with a root cause analysis before reporting them to the risk management board.    An example is shown below for a technical risks identified for a hypothetical engineering project.

Samples of Root Cause Analysis for Investigating the Fundamental Causes of a Risk to Support the Mitigation Planning

New ID#

Risk Title

Causes of the Threat (Event associated with concern)

Causes of Cause

Root Causes

1

Mirror/Optics alignment & calibration accuracy

- Not getting final design from the vendor in time

-Material unavailable
- Light-weighting of material
- Design too complex
- Damage to optics by vendor (1 set of spares)
- High tolerance requirements take longer to produce
- Insufficient performance margins built into design

- Attempt to optimize the design since there is only time for one design cycle
- Material availability not taken to account during design
- Impact of light-weighting on complexity not taken into account during design
- Design for manufacturing not taken into account during design
- Lack of spares or inability to recover from mistakes or poor quality processes
- Design for manufacturing not taken into account during design
- Setting design standards (requirements) too high relative to vendor capability

-Too much emphasis on optimizing the design and insufficient consideration of designing for procurement
- Selection of vendor not capable of meeting the schedule and manufacturing quality of design
- Optics not designed for manufacturability/ insufficient participation by vendor to influence the design

From the above example, it is clear that the questionable quality of the optics could be due to either 1) insufficient concern for how the options are to be manufactured, 2) a vendor with insufficient optics manufacturing experience, and/or 3) insufficient participation by the vendor during the optics design to ensure their manufacturability.   

Return