The new suite of quality management standards will be effective in the UK from 15 December 2022. ISQM 1 especially may seem like a lot for a smaller practice to take on board, and that includes the application of root cause analysis (RCA). But it needn’t be daunting.

In this article from ICAEW’s Audit and Assurance Faculty, we look at five ways in which sole practitioners and other smaller audit practices can embrace RCA.

1) Seeing the positives

RCA isn’t just a compliance exercise, or something the regulators just ask for, it should be seen as a tool that drives continuous improvement and if embraced, can bring many positive outcomes:

• Improvements to recovery rates and profitability: when RCA is done well, there will be better action plans, leading to better audit quality. Better audit quality can lead to better recoverability, and more profitability.
• Positive RCA: RCA can be carried out on deficiencies, but can also be used positively to share good practice if it identifies things that went particularly well on an audit, such as an auditor developing a high-quality working paper that can then be used as a template on other audits. This can be motivating and rewarding for those auditors who have demonstrated good practices and behaviours.
• Sharing the learnings: the results of both positive and negative RCA can and should be shared with other audit partners (where applicable) and other auditors for the benefit of the practice as a whole.

Even where audit software is used, audit files are sometimes completed in very different ways depending on the responsible individual (RI) or auditor involved. Sharing learnings can help to encourage a consistency of approach and quality.

• Improving other services: the actions arising from RCA can similarly be shared across the practice, enhancing the quality of services across your business. In smaller practices the auditors may also be involved in accounts and tax work, so when they develop an RCA mindset this will automatically extend to other service lines.

For example, if RCA identifies the audit of disclosures was performed poorly or management omitted disclosures entirely and this wasn’t spotted by the auditor, this could be used to inform updates to your accounts preparation programme, improving its quality also.

• Eradicating recurring issues: many practitioners may experience the same points year on year from inspections. It can be rewarding to finally deal with these deficiencies, and allow you to focus on other areas where time is better spent.

2) Don’t be put off by the name

Chances are that you are already carrying out some form of RCA in your practice, even if not by name. If you are following up deficiencies identified during file reviews – internally, by a training organisation, ‘peer review’ by another registered auditor, or even following a QAD visit – chances are you have been trying to identify the causes and to stop them reoccurring. This is the essence of RCA, and you may just need to document this as RCA, before expanding on it as you become more familiar with it, and reap further benefits.

3) Take action

It is not likely to suffice to identify root causes and stop there. Developing an action plan is a key component of ensuring RCA prevents recurrences of deficiencies, and something that ICAEW’s QAD will expect to see more and more of. Make sure that actions are measurable, timebound, and identify an ‘owner’ responsible for each action.

Following up on the action plan is also key. It may be a simple tweak to a working paper to address a point raised on a particular audit file in the prior year. Has an appropriate change been made which may help prevent recurrence of the deficiency, or if not, is a junior just likely to ‘roll-forward’ the same working paper? Or is there an ‘aide-memoire’ on the audit file prompting the audit team to consider last year’s hot and cold file review points?

4) RCA will be refined over time, and you have to start somewhere

It is not expected that you will be able to do all the required RCA at once, or indeed identify the correct root cause(s) first time. It may well be that actions identified do not lead to the deficiencies disappearing after one audit cycle. But as you refine the process and learn from it, actions will become more targeted and effective.

For identified deficiencies that prove more difficult to find root causes for, it would be advisable to engage with an external reviewer or training organisation to draw on their experience with a wide range of different firms. QAD reviewers are also happy to share insights on good practice during audit visits.

Developing a mindset, or firm culture, of continuous improvement, rather than a once-a-year response to criticism of audit work, often leads to a more positive attitude to audit work, and so higher quality and more efficient audits.

5) Decide who will do it

Smaller practices will likely not have dedicated RCA resource in their practice, but may still want to keep it in-house rather than using external suppliers. Partners or managers may be tasked with looking at each other’s audit files, and sole practitioners may be carrying it out themselves. Whatever the approach, clear responsibilities will need to be agreed, and time set aside for reviews, interviews, or other means of collecting information. The RCA is an extension to regular hot and cold file reviews, ensuring deficiencies are identified, RCA carried out on the most important ones, and all documented as RCA. Then, actions are developed, assigned, and prioritised.

Retaining talent is also an important consideration for most practices, and giving junior auditors some involvement in RCA may be a good way not only to generate fresh ideas for improvement, but also to promote development. And if juniors develop a habit of proactively improving working papers, it becomes second nature, and may make future RCA less daunting.

You might also find the following articles from the Audit and Assurance Faculty helpful:

• How to get started with root cause analysis
• Action planning and continuous quality management
• Root cause analysis: finding the way