Getting to the Root Cause
Westpac’s recently released Culture, Governance and Accountability (CGA) Reassessment Report provides an open acknowledgment that the work they have conducted in this space to date has not yet achieved the desired results, and that they continue to fall short of where they want to be with respect to the management of non-financial risks.
This scenario is unlikely to be unique to Westpac, with many financial institutions identifying areas of needed improvement flowing out of findings from their own Governance, Culture, Remuneration and Accountability (GCRA) self-assessments and also from the Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry. Many of these organisations are also still implementing changes designed to improve their own management and understanding of non-financial risks, in addition to invoking meaningful changes to risk culture and accountability.
Underpinning the findings in Westpac’s Reassessment Report is the acceptance that the organisation has a fundamental weakness in getting to the bottom of, and addressing, the root cause of issues. This is referenced in a number of ways, in particular insufficient analysis and understanding of weaknesses previously identified in their management of non-financial risks. However, it extends beyond this into other aspects of the bank, including incident management and complaints handling. As a result, Westpac’s new Customer Outcomes and Risk Excellence (CORE) work program is centred around specifically addressing identified root causes and assigns accountability to help ensure that each one is fully remediated.
As can be seen through Westpac’s example, issues like insufficient understanding of risks and roles across the business can hinder an organisations ability to fully appreciate and remediate the underlying root cause. Other common pitfalls when conducting root cause analysis include:
* Focusing too heavily on user errors.
While a simple human error is certainly a possible explanation for a breach or incident, not undertaking a sufficient analysis of root causes will typically result in process or procedural weaknesses going unidentified. It’s relatively easy to conclude that a minor user error won’t happen again if users are regularly trained, however, this fails to take into account potential control weaknesses that could be contributing to the errors occurring in the first place. Failing to look far enough beyond user errors inhibits the ability to identify opportunities for improvement.
* Not delving deep enough into the cause.
Relating to the point above and the ease of focussing on a ‘simple’ explanation for why things have gone wrong, root cause analysis often doesn’t cut far enough through all the layers of complexity to identify where issues are occurring and what particular parts have failed, before finally concluding on the ultimate question of ‘Why’.
Another aspect of this is confirmation bias, where those conducting the analysis enter into this activity with preconceived answers and, as a consequence, don’t consider additional factors or ignore conflicting evidence. Gaining a deeper understanding of root causes may also be hampered where people lack the skills to fully understand the issue. People will only find root causes that they know about and are familiar with, meaning that connections outside of their immediate department will often go unnoticed or unchecked.
* Not identifying solutions that are suited to solving the actual root cause, or applying ‘Band-Aid’ fixes.
Many people tasked with resolving an incident or responding to a complaint will focus solely on addressing the issue at hand as an individual issue and may not think, or make the time, to look beyond this. This is potentially out of concern for what challenges they might find, but in essence is likely motivated by a lack of accountability for broader issues that might be uncovered. The result of this is that larger procedural or product changes don’t end up occurring because accountability is not assigned or people feel unsupported in taking on the additional work that this creates. People will begin to ignore problems that they think are too big or difficult to fix.
If the mindset for finding problems and fixing them is not a dominant feature in the organisational culture, people will view tasks stemming from the management of incidents or complaints as actions to be closed out, rather than opportunities to improve the business and outcomes for customers. This is a concern that Westpac is now attempting to address, acknowledging that they have a culture of blame and one that has a “tendency to focus on individual issues rather than broader shortcomings”.
* Failing to follow through with remedial activities.
Once root causes have been identified, remedial activities should be undertaken to fully address them. This circles back to the previous point around accountability. If broader strategic programs of work are identified from root cause analysis, transparent accountability of this should be assigned early on. Otherwise, over time, actions can get rolled back or overridden to the point where the original purpose, to address the root cause of a wider issue, is forgotten. Poor execution of solutions, or programs of work that are only partially implemented, also serve to undermine the remediation process.
A really important realisation by Westpac in its most recent analysis is that of the impact of its deeply embedded cultural traits. Traits that it views are hindering its ability to make progress. One particular cultural concern that has a significant impact on the quality of root cause analysis is that of blame.
While organisations may not have set out to create such a culture, many of them are now finding themselves with a deep-seated culture of placing blame or finding excuses for things that have gone wrong rather than focusing on learnings or opportunities for improvement. This has stemmed out of consequence management approaches and hasn’t really shifted alongside endeavours to enhance accountability throughout the industry.
These sorts of defensive attitudes towards obstacles when they arise are not conducive to customer focused problem solving. From a cultural perspective, the focus should be shifted onto other aspects like time to resolution and quality of resolution, rather than focussing on the sheer number of issues/incidents/complaints. Metrics set purely around number of events can actually dissuade people from speaking up and encourages resentment from those who are allocated tasks as part of remediation, as they are taken away from their own work to ‘clean up someone else’s mess’.
It’s important, therefore, that root cause analysis concludes with practical business improvements, so that they can be presented less like problems and more like opportunities, and assigned accountabilities to promote follow through. This way organisations can avoid issues of blame and instead foster a culture that supports holistic improvement.
In addition to addressing a ‘blame culture’, other strategies for improving root cause analysis and remediation include:
* Training people.
Upskilling first line staff to better understand risk, and the role of controls in place to mitigate those risks, is critical to improving root cause analysis and remedial activities. Westpac has identified that there are skills gaps in non-financial risk management and that their three lines of defence model is not understood well enough. This in itself could be a contributor as to why their initial program of work, while identifying a wide range of recommendations, didn’t initially cut through to the root cause of these.
* Keeping records.
Corporate memory plays a part in this as well; forgetting why a problem occurred and how you fixed it will lead to a repeat of the problem. Centralised recording of root cause analysis can help avoid this. It also provides an avenue to hold projects and people accountable for complete resolution of identified root causes and enables the lessons learnt to be captured and applied to future projects.
* Implementing Root Cause Analysis tools or templates.
Implementing a standardised way to conduct root cause analysis not only fosters consistency in the approach, but can help promote structured conversations about what to look for in root cause analysis that will help people to further their analysis. This in turn will bring about a greater analysis on what has occurred, rather than focussing on who was responsible, which can help alleviate issues of blame.
To summarise, not conducting sufficient root cause analysis, or not identifying the true underlying factors contributing to an issue, prevents a business from appropriately addressing the whole problem. Improving root cause analysis and ensuring that findings are presented as a core part of the remediation work helps to promote accountability and helps lead to a better focus on outcomes. While thorough root cause analysis is particularly important for complaints management, incident handling and project management, it has wide ranging impacts all the way through to conduct and culture.
If you need help improving your root cause analysis, or are interested in discussing how root cause analysis could improve your work programs, get in touch with us at Hall Advisory. We are also experienced in conducting GCRA assessments, providing an independent perspective and recommendations to strengthen your business across each of these non-financial risk areas.
