Risk Management - Root Cause Analysis

| Home | Guidelines | Manage | Organize | Identify | Assess | Root Cause Analysis
| Mitigate | Monitor & Control |

When a risk first surfaces, those who have identified it will likely be describing the symptoms and surface issues, because this is what they see first and what is understandable. However, the cause of most risks usually run deeper, and one should not rush to the conclusion that they have identified the true nature of a risk until they probe deeper with a root cause analysis.    The risk should not be defined at this point as its description might suggest remedies and mitigations that are misdirected and inefficient.  Instead, a root cause analysis must be performed to find the underlying conditions for the concerns of the person or team who first identified the risk.    By spending extra timer understanding the causes of a risk, it makes the job of mitigating the risk so much easier.  The solution to a well defined and described risk is direct and efficient...simply find a way to remove the root causes.

A root cause analysis simply takes all the symptoms and asks the question of each, “What is causing the cause of these conditions?”  The answers to this question is recorded.  The question is asked again, “What is causing the causes just identified?”  This process of asking and answering the same question repeatedly will ultimately lead to one of the two answers: 1) insufficient resources (funding or time) that prevent any other course of action or 2) management deficiencies, errors, and/or limitations.  Since both of these answers represent constraints to the project, the root cause becomes the answers just prior to the arrival of these constraints.  With the identification of the root causes, resolving the risk is simply the removal of the root causes.  

 4.5.1 Root Cause Analysis

Often, a risk is identified by someone who only observes the symptoms.  The purposes of a root cause analysis to investigate the risk to determine the causes to a deep a level to reveal the underlying source.  At this point, the risk is most effectively and efficiently resolved simply by finding ways to remove the root causes.  Thus, as new risks are proposed by the team members doing the work, these risks are investigated with a root cause analysis before reporting them to the risk management board.    An example is shown below a risk titled "Optics mirror alignment & calibration accuracy".

Samples of Root Cause Analysis for Investigating the Fundamental Causes of a Risk to Support the Mitigation Planning

New ID#

Risk Title

Causes of the Threat (Event associated with concern)

Causes of Cause

Root Causes


Mirror/Optics alignment & calibration accuracy

- Not getting final design from the vendor in time

-Material unavailable
- Light-weighting of material
- Design too complex
- Damage to optics by vendor (1 set of spares)
- High tolerance requirements take longer to produce
- Insufficient performance margins built into design

- Attempt to optimize the design since there is only time for one design cycle
- Material availability not taken to account during design
- Impact of light-weighting on complexity not taken into account during design
- Design for manufacturing not taken into account during design
- Lack of spares or inability to recover from mistakes or poor quality processes
- Design for manufacturing not taken into account during design
- Setting design standards (requirements) too high relative to vendor capability

-Too much emphasis on optimizing the design and insufficient consideration of designing for procurement
- Selection of vendor not capable of meeting the schedule and manufacturing quality of design
- Optics not designed for manufacturability/ insufficient participation by vendor to influence the design

The contractor is the risk owner and were concerned that the vendor they hired couldn't do the job of making an optics devise that would meet their requirements for alignment and calibration accuracy.   After some investigation (root cause analysis), the risk was found to be due to the following root causes: 1) insufficient consideration given during the design of the optics devise for the vendor's ability to manufacture it, 2) the vendor they selected may not be capable of the meeting the high quality standards of the design requirements, and 3) insufficient participation by the vendor during the design to ensure that the optics design is manufacturability give the vendors capabilities.  Given these potential root causes to the contractor's concern regarding the the optics alignment/calibration accuracy, the local areas for seeking remedied is to reverse these root causes.  First, the contractor needs to begin taking into consideration the vendor's manufacturing capability before finalizing the design as there is no point in designing something that cannot be manufactured by your vendor.    Second, the contractor could consider another vendor and possibly paying more for a vendor with more capability given the fact that the design they have selected will be tough to manufacture.  Third, the contractor could begin a more collaborative effort with the vendor to ensure that they can successfully manufacture the final design (so long as the optical devise meets the higher-order purpose). 

Thus, the purpose of performing a root cause analysis as part of the risk identification step is to describe the risk closer to its source.   This helps make it easier to mitigate a risk, because the remedies are suggested by the root causes.