Root or Symptom
Twelve findings, each with the detail that gives the cause away. “The reviewer did not check” is true in most of them — and it names a person where the cause is design, capacity or incentive.
1. Monthly reconciliations are signed off but three of twelve show unexplained differences carried forward. The preparer reconciles forty accounts alone in the two days before reporting.
2. Access reviews are completed on time every quarter and approve 100% of rows. The reviewer receives a spreadsheet of group names with no descriptions.
3. Change tickets are raised after deployment. Developers say the pre-approval queue takes three days and their release cadence is daily.
4. A sales team consistently books revenue in the wrong period. Their commission is calculated on booked date and paid quarterly.
5. Data classification is applied to 12% of new documents. It was introduced in an all-staff email nine months ago and appears in no onboarding material.
6. Vendor bank-detail changes are made without callback verification. The procedure requires callback; the finance system has no field to record that it happened.
7. Incident post-mortems are not completed. The team that would write them is the same team firefighting the next incident, and headcount has been flat through a doubling of volume.
8. Nobody performs the quarterly supplier assurance review. Procurement says it is risk's, risk says it is procurement's, and the policy names neither.
9. Managers approve their own team's expenses within seconds of submission. Their objective is expense turnaround time.
10. Password policy exceptions are granted routinely. The approver is the service desk, whose SLA is measured on ticket closure.
11. Backups are configured for every server except three added last year. Server build has a checklist; the checklist has no backup step.
12. Mandatory training completion sits at 61%. Reminders go to a distribution list built three reorganisations ago.
Educational. Cause taxonomies differ between methodologies; what transfers is the test of whether a diligent person could have failed here anyway — because if they could, the cause is not the person.