Your Agency underwent an audit and has received the findings from the auditor. Now what do you do? Do you apply a Band-Aid, or do you address the root of the problem? If you’re looking to save time, resources, and avoid repeat findings in subsequent years, digging deeper is imperative.

Even if the problem found is somewhat small, it indicates that something within your processes is broken. If you don’t fix it, this year’s $1 million issue could grow to become a $50 million issue next year.

Root cause analysis digs deep and asks “Why?” Why did you receive this audit finding? Why does this problem exist? By focusing on root causes, the real issue is exposed, allowing you to dedicate time and resources to a legitimate solution. The analysis begins with the “Five Whys” technique, and the questions continue until the true root cause is identified; typically, it should take no more than five questions to get there. Generally speaking, the root cause is tied to one of three things: a process, the people involved in a process, the technology used to execute a process, or the underlying data.Let’s look at an example from home ownership—a leak in your basement. Why do you have a leak in your basement? Some water came in. Why did the water come in? There is a gap under the door into the basement. Why is there a gap there? The door is off the hinge. Why is the door off the hinge? You should continue to ask “Why?” until you discover the true root cause.

This method of information digging is similar to how doctors diagnose an illness. Too many times, people become focused on a symptom (e.g. water came into the basement.) A symptom alone, however, fails to identify the cause. There are many ways to alleviate symptoms that simultaneously fail to cure the underlying issue.

At MorganFranklin Consulting, we work with clients on performing root cause analysis and developing corrective action plans aimed at alleviating problems, not symptoms. We begin in a workshop setting, getting everyone into a room to have the Five Whys discussion. Once we have the root cause—again, generally a process, people, technology, or data issue—we sit together and figure out a plan. If it’s a people problem, can we hire somebody new or provide additional training? If it’s a process issue, what can we change or do different within the process? If it’s a technology issue, how can we modify the existing technology or do we need a new technology solution?

We document the plan in a Corrective Action Plan (CAP) format that lists the steps your Agency should take and milestones for when and how you’ll know you’ve completed them. Milestone might include developing a policy or procedure, whereas the tasks will be more detailed, such as meeting with process owners, reviewing existing policy, and documenting a draft. Importantly, each task will be assigned to a specific person, so everyone knows who’s responsible for what.

Understanding the root cause of your Agency’s deficiencies and developing CAPs to remediate the issues are essential to improving the efficiency and effectiveness of your operations to successfully achieve your objectives. For more information about how MorganFranklin can assist your organization, visit our Audit Remediation services page.


We are experienced, engaged professionals that are highly energetic and motivated to work in challenging, high stakes environments.