


{"id":1147,"date":"2019-09-20T23:13:54","date_gmt":"2019-09-20T23:13:54","guid":{"rendered":"https:\/\/alminawi.com\/?p=674"},"modified":"2025-08-16T13:59:04","modified_gmt":"2025-08-16T13:59:04","slug":"674-2","status":"publish","type":"post","link":"https:\/\/e.americanpro.org\/?p=1147","title":{"rendered":"Tools &#038; Techniques: Episode 11 \u2013 Root Cause Analysis: Barrier Analysis Diagrams"},"content":{"rendered":"<h3 data-start=\"90\" data-end=\"138\">\ud83d\udd0d Introduction to Barrier Analysis Diagrams<\/h3>\n<p data-start=\"140\" data-end=\"624\"><strong data-start=\"140\" data-end=\"169\">Barrier Analysis Diagrams<\/strong> are used in <strong data-start=\"182\" data-end=\"205\">root cause analysis<\/strong> to assess the effectiveness of <strong data-start=\"237\" data-end=\"261\">controls or barriers<\/strong> that are meant to prevent or mitigate unwanted events. Common in <strong data-start=\"327\" data-end=\"345\">internal audit<\/strong> and <strong data-start=\"350\" data-end=\"369\">risk management<\/strong>, this tool helps identify where barriers failed, were missing, or were bypassed\u2014leading to process failures or incidents. The method is especially useful when evaluating <strong data-start=\"540\" data-end=\"561\">operational risks<\/strong>, safety breaches, or compliance breakdowns across departments.<\/p>\n<hr data-start=\"626\" data-end=\"629\" \/>\n<h3 data-start=\"631\" data-end=\"685\">\ud83e\uddf0 Template for Applying Barrier Analysis Diagrams<\/h3>\n<p data-start=\"687\" data-end=\"747\">Use the following steps to apply this technique practically:<\/p>\n<ul data-start=\"749\" data-end=\"1165\">\n<li data-start=\"749\" data-end=\"810\">\n<p data-start=\"751\" data-end=\"810\"><strong data-start=\"751\" data-end=\"792\">Step 1 \u2013 Define the Undesirable Event<\/strong>: What went wrong?<\/p>\n<\/li>\n<li data-start=\"811\" data-end=\"872\">\n<p data-start=\"813\" data-end=\"872\"><strong data-start=\"813\" data-end=\"845\">Step 2 \u2013 Identify the Target<\/strong>: Who or what was affected?<\/p>\n<\/li>\n<li data-start=\"873\" data-end=\"924\">\n<p data-start=\"875\" data-end=\"924\"><strong data-start=\"875\" data-end=\"900\">Step 3 \u2013 List Threats<\/strong>: What caused the event?<\/p>\n<\/li>\n<li data-start=\"925\" data-end=\"999\">\n<p data-start=\"927\" data-end=\"999\"><strong data-start=\"927\" data-end=\"957\">Step 4 \u2013 Identify Barriers<\/strong>: What controls should have been in place?<\/p>\n<\/li>\n<li data-start=\"1000\" data-end=\"1089\">\n<p data-start=\"1002\" data-end=\"1089\"><strong data-start=\"1002\" data-end=\"1037\">Step 5 \u2013 Analyze Barrier Status<\/strong>: Were they effective, failed, missing, or bypassed?<\/p>\n<\/li>\n<li data-start=\"1090\" data-end=\"1165\">\n<p data-start=\"1092\" data-end=\"1165\"><strong data-start=\"1092\" data-end=\"1127\">Step 6 \u2013 Recommend Improvements<\/strong>: Strengthen or redesign key barriers.<\/p>\n<\/li>\n<\/ul>\n<hr data-start=\"1167\" data-end=\"1170\" \/>\n<h3 data-start=\"1172\" data-end=\"1227\">\ud83c\udfe2 Example: ACME Corporation \u2013 Data Breach Incident<\/h3>\n<p data-start=\"1229\" data-end=\"1402\">At ACME, a recent <strong data-start=\"1247\" data-end=\"1262\">data breach<\/strong> during a system upgrade prompted an internal audit by <strong data-start=\"1317\" data-end=\"1326\">Auren<\/strong>, with support from <strong data-start=\"1346\" data-end=\"1370\">Project Manager Aven<\/strong> and oversight by CEO <strong data-start=\"1392\" data-end=\"1401\">Liora<\/strong>.<\/p>\n<ul data-start=\"1404\" data-end=\"1710\">\n<li data-start=\"1404\" data-end=\"1466\">\n<p data-start=\"1406\" data-end=\"1466\"><strong data-start=\"1406\" data-end=\"1427\">Undesirable Event<\/strong>: Unauthorized access to customer data.<\/p>\n<\/li>\n<li data-start=\"1467\" data-end=\"1528\">\n<p data-start=\"1469\" data-end=\"1528\"><strong data-start=\"1469\" data-end=\"1479\">Threat<\/strong>: External hacker exploited system vulnerability.<\/p>\n<\/li>\n<li data-start=\"1529\" data-end=\"1710\">\n<p data-start=\"1531\" data-end=\"1553\"><strong data-start=\"1531\" data-end=\"1552\">Barriers Assessed<\/strong>:<\/p>\n<ul data-start=\"1556\" data-end=\"1710\">\n<li data-start=\"1556\" data-end=\"1583\">\n<p data-start=\"1558\" data-end=\"1583\">Firewall: operational \u2705<\/p>\n<\/li>\n<li data-start=\"1586\" data-end=\"1622\">\n<p data-start=\"1588\" data-end=\"1622\">Access controls: misconfigured \u274c<\/p>\n<\/li>\n<li data-start=\"1625\" data-end=\"1665\">\n<p data-start=\"1627\" data-end=\"1665\">Change approval protocol: bypassed \u274c<\/p>\n<\/li>\n<li data-start=\"1668\" data-end=\"1710\">\n<p data-start=\"1670\" data-end=\"1710\">Staff training on security: inadequate \u274c<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p data-start=\"1712\" data-end=\"1863\"><strong data-start=\"1712\" data-end=\"1723\">Outcome<\/strong>: Auren\u2019s audit report recommended reinforcing approval controls, improving IT staff training, and implementing automated access monitoring.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\ud83d\udd0d Introduction to Barrier Analysis Diagrams Barrier Analysis Diagrams are used in root cause analysis to assess the effectiveness of controls or barriers that are meant to prevent or mitigate unwanted events. Common in internal audit and risk management, this tool helps identify where barriers failed, were missing, or were bypassed\u2014leading to process failures or [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":1015,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[17,12],"tags":[],"class_list":["post-1147","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-internal-audit","category-project-management"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/e.americanpro.org\/wp-content\/uploads\/2021\/03\/7-e1750016016710.webp","_links":{"self":[{"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/posts\/1147","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1147"}],"version-history":[{"count":1,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/posts\/1147\/revisions"}],"predecessor-version":[{"id":1263,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/posts\/1147\/revisions\/1263"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/media\/1015"}],"wp:attachment":[{"href":"https:\/\/e.americanpro.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1147"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1147"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1147"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}