Root Cause Analysis
What is Root Cause Analysis?
A systematic process for identifying the fundamental causes of problems, nonconformities, or incidents. Root cause analysis ensures that corrective actions address underlying issues rather than symptoms.
Terms that appear alongside root cause analysis
Each of these is named in at least one of the same controls as root cause analysis. The number is how many controls name both.
- corrective action 11 shared controls
- lessons learned 11 shared controls
- nist 7 shared controls
- security incident 6 shared controls
- incident response 6 shared controls
- post incident review 4 shared controls
- remediation 4 shared controls
- risk assessment 4 shared controls
Frameworks that govern root cause analysis
What the standards actually require on root cause analysis
Requirements naming root cause analysis across 6 standards, quoted from the control text.
The site must have a procedure for dealing with, and correcting, any issue found in its management system for food safety and quality, and the procedure must include finding the root cause and acting to stop it recurring.
brcgs-global-standard-for-food-safety-issue-9::3.7.1 · 3.7.1 A procedure for correcting issues with root cause analysis and preventive action →Identify and trace what ultimately causes data quality to be poor, remove those causes and develop solutions, because clause 4 explains that correcting errors alone lets them recur and that lasting improvement usually comes through better processes.
iso-8000-data-quality::61:6.5.2 · 6.5.2 Root Cause Analysis and Solution Development (DQI.1) →The Supplier defines its process for root cause analysis of nonconformities, including the tools and techniques it uses (root cause analysis being the collective term for approaches, tools and techniques that identify causes of nonconformity, 3.3.10).
nato-aqap-2110-quality-assurance-requirements-for-design-development-and-production::5.6.1 · 5.6.1 Define the root cause analysis process, tools and techniques for nonconformities →Root-cause analysis of incidents examines causes, the response and the control weaknesses that allowed them, and corrective actions are taken, including updates to the response plan.
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-3i · RESPONSE-3i: Root-cause analysis performed and acted on →In resolving vulnerabilities, root cause analysis is performed and, to the greatest extent possible, entire vulnerability classes are remediated.
ISM-1909 · Root cause analysis of vulnerabilities →Analyse the root causes of security vulnerabilities. In reviewing vulnerabilities, root cause analysis looks at the underlying problems that give rise to flaws in code, so development teams can go further than patching each vulnerability as it appears.
CIS-16.3 · Perform Root Cause Analysis on Security Vulnerabilities →Questions people ask about root cause analysis
What is Root Cause Analysis?
Why is Root Cause Analysis important for compliance?
Which compliance frameworks address Root Cause Analysis?
Where can I learn more about Root Cause Analysis?
See how Root Cause Analysis applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.