Programs, Architecture & Analytics

Root Cause Analysis System

Root CauseThinkGRC Root Cause Analysis System

The ThinkGRC Root Causes Analysis System (RCAS) is a methodology, program and system for problem & incident classification, reporting and analysis. It is designed with three primary tenets of architecture: defined structure, data classification and trend analysis.  The RCAS contains both an incident and a root cause analysis classification system.  The system is primarily focused on Technology/Information Technology (IT) problems/incidents and operations but can easily be applied to any type of operation or industry.

The strength and major benefit of the ThinkGRC Root Cause Analysis System, is its data driven design approach. With this approach, the ThinkGRC RCAS differentiates from traditional approaches based on the primary aspect of data gathering for mass data and trend analysis vs. individual problem analysis only.  In practice, implementing traditional aspects/tools of root cause analysis with the ThinkGRC RCAS will give you the best combination of applied knowledge and usable data for your organization.

Before getting into the details of the ThinkGRC RCAS, let’s take a look at some of the benefits.

ThinkGRC Root Cause Analysis System Benefits

The ThinkGRC Root Causes Analysis System is both a reactive and proactive Risk Management tool.  The ThinkGRC RCAS is a reactive tool used to perform problem/incident investigation and root cause analysis for negatively impacting events (problems/accidents/incidents/non-conformances etc.).  The ThinkGRC RCAS can also be used as a proactive tool to forecast and predict probable events before they occur. This is done by aggregating data from the ThinkGRC RCAS classification system to identify trends based on Problem Types, Programs and Management Systems.

Benefits:

  • The ThinkGRC RCAS establishes a simple structured approach and standard classification system which removes the need for excessive training and enables quick implementation at scale.
  • The ThinkGRC RCAS is a data and analytics tool focused on trending data to find gaps in operations. It provides justification, action recommendation, and identifies risk to help align resources to mitigate and/or remove operational issues.
  • The ThinkGRC Root Cause Classification System (RCCS) provides a series of standard selections based on best practices and RCA research.  
  • The methodology provides a structured approach for Technology/Information Technology (IT) problems/incidents but can be applied to any type of industry or operation.

Why does the ThinkGRC Root Cause Analysis focus on Problems, Programs and Management Systems?

The ThinkGRC RCAS is meant to identify the trends in problems/incidents with the ultimate goal of identifying opportunities for improvement, providing information for better decision making and better allocation of human and financial resources to improve operations and reduce risk.  That being said, we break down information into three trendable data sets that when looked at in aggregate identify opportunities in organizational and operational areas.  

The three trendable data sets are Problems, Programs and Management Systems.  We will describe the basic reasoning for focusing on each set below.

Problems

Problem classifications are incident focused, they are meant to identify the tangible systems and problems/issues associated with the systems.  

Programs

Program classifications are focused on programs, project functions and operations.  They are meant to identify the problems and/or gaps in the structure, implementation or management of the aforementioned areas. Program classifications are areas where actions can be directly assigned to fix or remediate the problem(s)/issue(s).

Management Systems

Management System classifications are focused on the management, structure, process, procedures and culture of the operation and organization.  They are meant to identify the fundamental and major primary gaps of the aforementioned areas.  Management Systems are areas where a macro view must be used to assess how the organization/operation functions, and how the organization/operation is to be changed.  Change usually occurs in the form of culture, organizational health and leadership.

ThinkGRC Root Cause Analysis Tool Set

The ThinkGRC Root Cause Analysis System (RCAS) provides a structured approach to incident classification and root cause analysis.  The ThinkGRC RCAS is a systematic approach to incident and root cause classification designed with a focus on Technology/Information Technology (IT) problems/incidents and operations.  The intent is to take some of the “art” out of RCA, and apply more “science”.  The ThinkGRC RCAS is meant to be a standard system which can be easily trained, implemented, and adopted as a standard throughout an organization.  By using this approach, we can easily turn everyone in an organization into a “Root Cause Investigator” with a minimal amount of training.  It is not only important to aid root cause analysis in response to incidents, but to develop a manner of thinking and culture around root cause analysis.    

The ThinkGRC Root Cause Analysis System is a simple set of tools that are meant to be used in tandem.  The tools are briefly described in the following.

In sum, the ThinkGRC RCAS is a combination of three tools provided in a single format:

  1. A – Map
  2. A – Method of Question Asking
  3. A  – Classification System for problems/incidents and root cause analysis.

The ThinkGRC RCAS Map

To make things easy, the ThinkGRC RCAS provides a Root Cause Analysis Map which contains all of the items that you will need to complete the RCA from start to finish.  The map provides a viewable flow for the administration of questions and selections.

The Map is presented as a top down navigation/selection system where you begin with the problem/incident statement at the top, and begin asking the presented questions, and making the selections as you proceed down the Map.  If multiple selections are required a each step of the map, then the user would complete the map selection process multiple times from start to finish.  

The Map also contains the ThinkGRC RCAS Classification System.  The RCAS Classification System selections will be presented below in detail, for now let’s discuss how the Map is broken down from a selection standpoint.  

ThinkGRC Root Cause Map

Download

The ThinkGRC Root Cause Classification System is focused on three primary tenets:  Problems, Programs and Management Systems.  Within each of the tenets there are additional sections and classifications to drill-down.  The objective is to navigate from Problem identification, to Program identification, to Management System identification.  

Root Cause Classification System:

  • Problems – Issue Types and Classifications
    • Problem
    • Problem Category
    • Problem Type
  • Programs (Initial Causes)
    • Causal Factor Operator
    • Causal Factor
  • Management Systems
    • Root Cause Operator
    • Root Cause

A – Method of Question Asking

The ThinkGRC RCAS provides a method of asking questions at each level of the map to facilitate the select process.  The map user should ask each question starting at the top with the problem/incident statement and then proceed down the map asking each question within the framework of the next.  A selection must be made at each level of the map.

The methodology of Question Asking has been provided below.  Take a look at the questions and think about how they relate to incident investigation, root cause analysis and the three tenets presented: Problems, Programs and Management Systems.

  • Problems – Issue Types and Classifications
    • Problem
      • Question = Was the incident/issue a? (select one)
    • Problem Category
      • Question = Where did the incident/issue originate? (select one)
    • Problem Type
      • Question = How would you classify/code this type of incident/issue? (select one)
  • Programs (Initial Causes)
    • Causal Factor Operator
      • Question = The incident/issue was caused due to a? (select one)
    • Causal Factor
      • Question = In the area of? (select one)
  • Management Systems
    • Root Cause Operator
      • Question = This incident/issue was caused do to our Management System, how would you classify the issue type? (select one)
    • Root Cause
      • Question = The Root Cause of the incident/issue can be best related to the following Management System area? (select one)

A – Classification System for Problems, Incidents and Root Cause Analysis

As mentioned above, the ThinkGRC RCAS is structured along three primary tenets of problems/incident causation: Problems, Programs and Management Systems.

The ThinkGRC RCAS Classification System mainly focuses on Technology/Information Technology (IT) consisting of common problem types, programs and  management systems involved in Infrastructure & Application Support Operations, Software Development, IT Project Management and everything else Enterprise Technology related.  Although it is mainly Technology focused, it can be applied to nearly any operational issue or organization.

The classification system is twofold.  It is designed to identify the “causes” of problems/incidents from a technology standpoint; while simultaneously classifying the problems/incidents as related to operational “Programs”  and organizational “Management Systems”.

The most important part of the ThinkGRC RCAS is what it will do for you overtime.  The ThinkGRC RCAS Classification System is designed to be reportable through data aggregation and trend analysis.  Data aggregation, trend analysis, and reporting will enable identification of systematic problems/incidents within your organization and provide the supporting data & justification for resource allocation and change.

In the following, we will define each step of the Root Cause Classification System and present the selections that are used for trend analysis.

Problem Classification Selection

In the first step, we make our selection for the Problem.  The Problem is the upper tier classification.  Based on the view and structure of today’s technology organizations, we first determine whether the problem/incident was related to Software or Infrastructure.

Problem Classifications:

  • Software Issue
  • Infrastructure Issue

Problem Category Selection

In the this step, we make our Problem Category selection.  Once again, we are simplifying things by providing five common technology areas to create buckets for trendable data. You would select the one that best relates.

Problem Category Classifications:

  • Application
  • Network/Switches
  • Server
  • Security
  • Facilities/Data Center

Problem Type Selection

In the this step, we make our Problem Type selection.  The Problem Type is meant to define the actual impacting event.  The selections below are an aggregation of the most common types of Technology/Information Technology (IT) failures represented in multiple professional practices.

Problem Type Classifications:

  • Human Error
  • Fault
  • Failure
  • Error
  • Exception
  • Crash
  • Bug
  • Interruption
  • Defect
  • Outage
  • Cascading Effect
  • Breach
  • Degradation

Causal Factor Operator Selection

In the this step, we make our Causal Factor Operator selection.  The Causal Factor Operator is a operator/descriptor selection related to the Causal Factor.  To select the Causal Factor Operator, you must simultaneously review the Causal Factor section.  The Causal Factor Operator and Causal Factor should be selected together and represented this way during reporting.  

Causal Factor Operator Classifications:

  • Identification/Scope Issue
  • Implementation Issue
  • Control Issue
  • Usage Issue
  • Interpretation/Consistency/Clarity Issue
  • Existing Issue
  • Review/Testing/Verification Issue
  • Analysis Issue
  • Frequency/Timing Issue
  • Deviation Issue
  • Compliance Issue
  • Reliability Issue
  • Data Issue
  • Knowledge Issue
  • Vendor Issue
  • Configuration Issue

Causal Factor Selection

In the this step, we make our Causal Factor selection.  The Causal Factor represents “Programs” which are common operational areas.  When identifying a Causal Factor, you are saying that “we” have a type of “issue” within one of our Programs.  The Causal Factor Operator defines/identifies the type of issue that “we” the “organization” are having.  In practice, Causal Factor Operator + Causal Factor = Type of Program Issue.

Causal Factor Classifications:

  • Change Mgmt./Integration
  • Design/Engineering/Development
  • Work Environment
  • Procedure
  • Risk Analysis
  • Sourcing/RFP/Licensing/SLA
  • Project/Operations Mgmt.
  • Training
  • Communication
  • Maintenance
  • Resources/Performance (Human)
  • Vendor Performance Mgmt.
  • Technology Selection/Age/Tools
  • Quality/Assurance/Release
  • Equipment/Material/Parts

Root Cause Operator Selection

In the this step, we make our Root Cause Operator selection.  The Root Cause Operator is a operator/descriptor selection related to the Root Cause.  To select the Root Cause Operator, you must simultaneously review the Root Cause section.  The Root Cause Operator and Root Cause should be selected together and represented this way during reporting.  

Root Cause Operator Classifications:

  • Identification/Scope Issue
  • Implementation Issue
  • Control Issue
  • Usage Issue
  • Interpretation/Consistency/Clarity Issue
  • Existing Issue
  • Review/Testing/Verification Issue
  • Analysis Issue
  • Frequency/Timing Issue
  • Deviation Issue
  • Compliance Issue
  • Reliability Issue
  • Data Issue
  • Knowledge Issue

Root Cause Selection

In the this step, we make our Root Cause selection.  The Root Cause represents “Management Systems” which are the fundamental building blocks of an organization’s operations and culture.  When identifying a Root Cause, you are saying that the organization has fundamental issue(s) with how they conduct operations; better described as “Management Systems”.  The Root Cause Operator defines/identifies the type of issue with the Management System.  In practice Root Cause Operator + Root Cause = Type of Management System Issue.

Root Cause Classifications:

  • Resources (Human)
  • Process
  • Procedures
  • Communications/Response
  • Monitoring (Operations)
  • Organizational Structure (Siloed Behavior)
  • Leadership/Management
  • 3rd Party/Vendor Management

Want to get going? Check out: How to use the ThinkGRC Root Cause Analysis System.

Interested is Reporting and Analysis: ThinkGRC Root Cause Analysis Reporting.

Previous | Next

Print Friendly, PDF & Email

Sharing

Facebooktwittergoogle_plusredditpinterestlinkedinmail