Speaker Profile

2. Speaker Profile Steven R. Melletz CPA, CIA, CGMA Senior Vice President in charge of directing the Financial Audit function at First Commonwealth Financial Corporation Member of the Board of Trustees of the Institute of Internal Auditors – Pittsburgh Chapter Former Chief Audit Executive of K-Sea Transportation, a publicly traded Transportation Company (defunct by acquisition). Former Manager at PwC and a BDO Seidman affiliate Former FDIC Accounting Technician who audited failed banks for transition to the assuming banks.

3. Disclaimer Anything that I say during this presentation is my opinion and not necessarily the opinion of First Commonwealth Financial Corporation, First Commonwealth Bank, or any of its subsidiaries. Some of the situations that I mention may or may not be true and the identities of any parties involved have been disguised.

4. What is This?

5. A Brief History Behind Root Cause Analysis (RCA) • Developed by Sakichi Toyoda who later founded Toyota Motor Company. • RCA was first used during the development of Toyota’s manufacturing processes in 1958.

6. Relation to the IIA Standards • Standard 2320: Analysis and Evaluation • Internal auditors must base conclusions and engagement results on appropriate analyses and evaluations. • Practice Advisory 2320-1: Analytical Procedures • Practice Advisory 2320-2: Root Cause Analysis • Practice Advisory 2320-3: Audit Sampling • Practice Advisory 2320-4: Continuous Assurance

7. Relation to the IIA Standards continued • Standard 2410: Criteria for Communicating • Communications must include the engagement’s objectives and scope as well as applicable conclusions, recommendations, and action plans. • Practice Advisory 2410-1 Communication Criteria • Standard 2420: Quality of Communications • Communications must be accurate, objective, clear, concise, constructive, complete, and timely. • Practice Advisory 2420-1

8. What is Root Cause Analysis? Root cause analysis (RCA) is defined as the identification of why an issue occurred vs. only identifying or reporting the issue itself. In this context, an issue is defined as a problem, error, instance of noncompliance, or missed opportunity.

9. What is Root Cause Analysis? continued Auditors whose reporting only recommends that management fix the issue and not the underlying reason that caused the issue are failing to add insights that improve the longer-term effectiveness and efficiency of business processes and thus, the overall governance, risk, and control environment. A core competency necessary for delivering insights is the ability to identify the need for root cause analysis and as appropriate, actually facilitate, review, and/or conduct a root cause(s) analysis.

10. What is Root Cause Analysis? continued Internal Audit can be the ideal group to analyze issues and identify root causes given their independence and objectivity. This perspective helps ensure biases are minimized, assumptions are challenged, and evidence is fully evaluated. Internal Auditors by working across various reporting chains and departments of an organization may have developed a broad and deep understanding of the underlying issues that may exceed that of any single member of management which makes them best positioned to analyze an issue. In circumstances where the root cause of an issue is a result of actions or inaction by management, it is critical to use an objective party such as Internal Audit to investigate and report back to Senior Management.

11. What is Root Cause Analysis? continued • Root cause analysis benefits the organization by identifying the underlying cause(s) of an issue. This approach provides a long-term perspective for the improvement of business processes. Without the performance of an effective root cause analysis and the appropriate remdiation activities, an issue may have a higher probability to reoccur. Root cause analysis helps prevent additional rework and proactively addresses future recurrences of the issues.

12. RCA Situations • RCA may be considered in any number of situations, such as those: • Involving a surprise risk event • Process failure • Asset damage or loss • Production stoppage • Safety incident • Quality degradation • Or Customer dissatisfaction.

13. RCA – 5 Why’s • RCA may be as simple as asking “five whys”: • The worker fell. Why? • Oil on the floor. Why? • Broken part. Why? • The parts keep failing. Why? • Changes in procurement practices. Why?

14. 5 Whys Continued • By the fifth why, the auditor should have identified or be close to identifying the root cause. More complex issues may require a greater investment of resources and more rigorous analysis. • Prior to commencing RCA for more complex issues, auditors should consider: • Time • Skill sets

15. Potential RCA Barriers • Prior to performing RCA, internal auditors should anticipate the following potential barriers: • Management may be reluctant to support internal audit’s role in RCA. You may need your CAE to explain roles to Management. • Management may resist due to time and resource commitments. • RCA may be difficult and subjective • RCA that leads to specific concrete observations and recommendations could be perceived to be placing the auditor in the role of Management.

16. Environmental Factors • Most root causes can be traced back to decisions, actions, or inactions by one or more employees. • Some of these could be: • Competence of personnel • Hiring qualified personnel • Lack of or insufficient training • Adequacy of technology or tools • Appropriateness of organization or departmental culture • Health of the organization or departmental morale • Level or number of resources (budget/personnel)

17. Environmental Factors Continued • Process circumstances and other influencing items that led the person or persons to make the decisions • Decision-making authority of the person or persons involved.

18. Techniques • Five Whys • Failure mode and effects analysis • SIPOC (Suppliers, inputs, processes, outputs, customers diagram. • Flowcharting of the process flow, system flow, and data flow. • Fishbone diagrams • Critical to quality metrics • Pareto chart • Statistical Correlation

19. RCA – 5 Why’s • Write down the specific problem - The worker fell. Why? • Write down answer; Oil on the floor. Ask 2nd Why? • Continue until what you consider is the true root cause is defined. • Don’t allow an early believable answer keep you from continuing to ask why. Broken part. Why? • The parts keep failing. Why? • Changes in procurement practices. Why?

20. RCA – Failure, Modes, and Effect Analysis • This is a step-by-step approach identifying all possible failures in a design, a manufacturing or assembly process, or a product or service. • What is process step? • What is key process input? • In what ways can the key inputs go wrong? • What is the impact on the outputs? • How severe is the effect to the customer? • What causes the potential failure? • How often does the failure occur? • What existing controls can prevent the failure?

21. RCA – Failure, Modes, and Effect Analysis continued: • How well can the failure be detected? • Multiply the severity, occurrence, and detection. • What actions can reduce the occurrence or improve detection?

22. SIPOC • High level process map showing Suppliers, Inputs, Process steps, Outputs, and Customers • We see how the pieces fit together:

23. Fishbone Diagram

24. Pareto Chart • A bar graph that categorizes the frequency of a certain type of event. • Could be used for customer or Hotline complaint types.

25. Five Cs • Criteria • Condition • Consequence/Effect • Cause • Corrective Action/Recommendation

26. Five Cs • Criteria • The law, regulation, contractual obligation, policy, procedure, or best practice that is expected to be followed • Condition • The factual analysis of the process as it exists • Consequence/Effect • Why the issue is important and noteworthy from a compliance, financial, or operational standpoint.

27. Five Cs • Cause • The root cause which allowed the condition to not emulate the criteria. • Corrective Action/Recommendation • Change that will address the root cause, allow the current condition to mirror best practice or other criteria and does not cost more in relation to its effect.

28. Situation 1 - Wire • Facts • Wire was released for $2,828,282,828.28 • Why was it released? Use 5 why’s

29. Situation 2 – Time Theft • Facts • Two workers decided to switch schedules. • Normally this would be OK if permission was asked, but that is not what happened in this situation.

30. Situation 3 – Compensation • Facts • Employees paid commission • Falsified records

31. Adding Value - Opportunities • RCA can be used in consulting opportunities requested by Management, the Audit Committee, by circumstances resulting from an audit, from many situations. • I have received these opportunities from: • Hotline calls • H.R. requests • Legal requests • Line of Business requests • Audit Committee requests

32. Adding Value - How • Do we create analysis that management does not currently have available? • Recommendations that Management has not considered. • Advising Senior Management, Audit Committee, Board of Directors of business risks and issues that they may not be aware. • Issues that they may want independently assessed.

33. Adding Value - How • Do we create analysis that management does not currently have available? Maybe it is available, but they want it to be independently verified. • Recommendations that Management has not considered. • Advising Senior Management, Audit Committee, Board of Directors of business risks and issues that they may not be aware. • Issues that they may want independently assessed.

34. Adding Value - How • Ask Management and the Audit Committee if there are any services you can provide. • Persuade them that you have the ability to provide value added services. If you can audit and perform fraud investigations, you can provide value-added services. • Make sure that you are ‘in the know’ of the Organization’s strategy, objectives, and goals. • Don’t settle with ‘no’. Go back and inquire periodically.

35. Sources • Institute of Internal Auditors Professional Standards and Guidance IPPF

36. Any Questions?

37. My Contact Information Steven R. Melletz CPA, CIA, CGMA SVP, Internal Audit First Commonwealth Financial Corporation Email: SMelletz@fcbanking.com Phone: 724.463.4707 Please feel free to email me with any questions.