There's a particular sinking feeling in compliance: an issue you remediated eighteen months ago reappears in an audit report, a complaints trend, or a supervisory question. The controls were fixed. The actions were closed. And yet here it is again. Almost always the reason is the same — the remediation addressed what happened, not why it happened.
Root cause analysis sits at the front of the FCA's remediation guidance for exactly this reason. FG26/2, published in March 2026, walks the lifecycle of a redress exercise beginning with root cause analysis and scoping decisions — because the cause determines the scope. How long the issue ran, which products and channels it touched, and therefore which customers were affected, all follow from understanding the mechanism. Get the cause wrong and every downstream decision — population, redress methodology, control fix — inherits the error.
Fix the trigger and you've bought a quiet period. Fix the mechanism and the finding stops returning.
The failure mode is recognisable. A cause gets recorded at the level of the immediate trigger: "the report wasn't reviewed," "the payment was miscoded," "the training wasn't completed." Each is true, and none is a cause. Ask why once more and you tend to reach the real one — a process with no owner, a control that depended on one person's diligence, a system change that went live without anyone testing whether the control still worked, an incentive that made the shortcut rational, or management information that reported activity rather than outcomes. Fix the trigger and you've bought a quiet period. Fix the mechanism and the finding stops returning.
Repeat findings also carry a disproportionate cost with the regulator. A first occurrence is a control failure. The same failure twice reads as evidence that the firm's governance didn't detect, understand or correct it — which speaks to management and control rather than to the individual issue. That is the territory in which attestations, requirements and skilled person reviews start to appear. It is also, in plain commercial terms, the more expensive path: doing the same remediation twice, with less goodwill the second time.
What firms should do
- Distinguish the trigger from the cause. Keep asking "why" until you reach something structural — ownership, design, incentive or information — rather than an individual action.
- Let the root cause drive the scope. Period, products, channels and affected population should follow from the mechanism, not be assumed first.
- Look for the same mechanism elsewhere. If a control here depended on one person's diligence, where else does it?
- Write the cause down in terms someone outside the team would understand, and record it where it can be tested later.
- Track repeat findings explicitly as a governance metric and report them to the board. A recurrence rate says more about your control environment than a count of closed actions.
Sources: FCA FG26/2, Finalised Guidance on identifying and rectifying harm (16 March 2026); FCA Handbook SYSC and SUP 5 (skilled person reviews); FCA supervision-led approach and Therese Chambers speech "Beyond the headlines" (17 June 2026).