Programs, Architecture & Analytics

How to use the ThinkGRC Root Cause Analysis System

Root CauseThinkGRC Root Cause Analysis System Tutorial.  This quick tutorial will provide all you need to quickly learn and execute the ThinkGRC Root Cause Analysis.

Video – How to use the ThinkGRC Root Cause Analysis System

How to use the ThinkGRC Root Cause Analysis System – Tutorial Contents

  • A brief introduction to the ThinkGRC Root Cause Analysis System
  • The ThinkGRC Root Cause Analysis Map
  • A guided tutorial on how to use the ThinkGRC Root Cause Analysis System & Map

A Brief Introduction

  • The ThinkGRC Root Cause Analysis System (RCAS) is a systematic approach to incident and Root Cause classification designed with a focus on Information Technology (IT) incidents and operations.
  • The ThinkGRC RCAS is structured along three primary tenets of incident causation: Problems, Programs and Management Systems.
  • The ThinkGRC RCAS provides a standardized classification system for training, recording, reporting and analysis.
  • To Learn more about the ThinkGRC RCAS please visit:

The ThinkGRC Root Cause Analysis Map

ThinkGRC Root Cause Map

We recommend downloading the RCAS Map prior to continuing with the tutorial.


Map Usage

  • A couple important points of note about using the MAP before we proceed:
  • For the purposes of this tutorial we will start at the top of the Map and record our classifications was we work our way down.
  • It is important to make and record your selection at each level of the map.
  • During this exercise you may find the need to make more than one selection at each level of the map.  This means that the issue/incident was caused by more than one variable which is very common.  If that is the case, simply run through the map start to finish multiple times making all of the relevant selections and record them in association with your issue/incident.

Sample Incident for Tutorial

  • We will use the following incident/issue as a sample and as the basis to make our selections please review:

“A Server entered a hung state due to a snapshot issue after a recent virtual machine upgrade.  It has been determined that the snapshot issues is due to a compatibility issue with the current storage configuration after the upgrade.”

Step 1 – Problem Classification Selection

  • Now let’s start with the issue/incident stated.
  • Go to the top of the map and ask yourself: Was the issue/incident caused by a Software Issue or an Infrastructure Issue?  Since we are IT focused and most groups/operations are broken down along these lines, this is the first primary area of differentiation that we will make.
  • We will select “Software Issue” as our top level Problem.

ThinkGRC_Problem Selection

Step 2 – Problem Category Selection

  • Next, think about and ask yourself: Where did the issue/incident originate (select one)?
  • These selections have been broken down into the five primary functions within an IT Corporate Enterprise operation.  We will select “Application” as our Problem Category.

ThinkGRC Problem Category Selection

Step 3 – Problem Type Selection

  • Next think about the type of problem that you had and ask yourself: How would you classify/code this type of issue/incident?
  • These selections are a collection of the most common IT Operations, Software Development and IT Project Management issues.  We will select “Failure” as our Problem Type.

ThinkGRC Problem Type Selection

Step 4A – Causal Factor Operator Selection

  • We will now move on to make our Programs (Initial Cause) selections.  On the left hand side of the map use the key to identify the Causal Factor Operator and the Causal Factor rows.
  • These two rows are dependent both from a selection and reporting standpoint.  What you want to do is look at the Causal Factor row to review the types of Programs that your organization is managing and determine the issue with the Program by identifying the Causal Factor Operator.

Step 4B – Causal Factor Selection

  • To make the selection do the following, ask yourself: The issue was caused do to a (Causal Factor Operator)?, In the area of (a Causal Factor/Program)?
  • For the purposes of this example, we will select the Causal Factor Operator= “Review/Testing/Verification Issue” and the Causal Factor = “Quality/Assurance/Release”.  When we record and report this issue/incident, we will state that there is a Review/Testing/Verification Issue within our Quality/Assurance/Release Program.

ThinkGRC Causal Factor Selection

Step 5A – Root Cause Operator Selection

  • Next, we will identify the Root Cause Operator and Root Cause.  These selections are also dependent.
  • Now ask yourself: This issue was caused due to our Management Systems, how would you classify the issue type (Root Cause Operator)? As it relates to the following question: The Root Cause of the issue can be best related to the following Management System area (Root Cause)? Review both rows and pick the best combination to represent the issue as it relates to your Management Systems.

Step 5B – Root Cause Selection

  • For the purposes of this example, we will select the Root Cause Operator = “Identification / Scope Issueand the Root Cause = “Process”.
  • Therefore, we would say that the issue ultimately originated due to an issues with our Management Systems where “we” the “organization” have a problem properly identifying and scoping Processes to properly manage our Programs and ultimately the delivery of business processes and functions.

ThinkGRC Root Cause Selection

Step 6 – Recording Selections

  • In practice, all of the ThinkGRC RCAS Map selections should be recorded and presented for reporting and trend analysis.  Future articles will contain additional information on RCA reporting and trend analysis.

ThinkGRC RCA Map Selections

Download the associated presentation or view on SlideShare.

Presentation Download:



Please Contact Us to provide feedback, ask questions and inquire about training opportunities.

Print Friendly, PDF & Email