A root cause analysis is a systematic process of identifying the underlying factors that caused the noncompliant conditions during the review of a control procedure. A root cause analysis can help to prevent the recurrence of the noncompliance, improve the effectiveness of the control procedure, and enhance the risk management process. A root cause analysis can be performed using various tools and techniques, such as the 5 whys, fishbone diagram, Pareto chart, or fault tree analysis. The other options are not as appropriate as a root cause analysis, because they do not address the source of the problem, but rather the symptoms or consequences of the noncompliance. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.3.3, page 130.