Since the International Standard on Quality Management (ISQM) 1 became effective on 15 December 2022 audit firms have been required to:

• establish and maintain a system of quality management (SoQM) which is tailored to the firm and its client base;
• design monitoring processes to provide timely information on the design, implementation and operation of this SoQM;
• evaluate findings from this monitoring to identify deficiencies;
• perform root cause analysis (RCA) on all identified deficiencies to assess their severity and pervasiveness and design effective remediating actions; and
• design, implement and operate their SoQMs to proactively manage the quality of their engagements.

Many of those in the audit profession were new to RCA, particularly in smaller independent firms, and some are still struggling to get the most from this unfamiliar concept. For those who want to revisit the basics, an Audit & Beyond article offering answers to 12 key questions on RCA may be a good starting point and this article is followed by pointers to other ICAEW resources to support smaller independent firms on their RCA journey. A report from the UK Financial Reporting Council (FRC) on RCA also offers learning opportunities.

During the 2023/24 inspection cycle, the FRC conducted a thematic review of ISQM 1-related RCA, focusing on policies, processes and procedures for the following overarching areas: 

• scoping RCA programmes;
• selecting, training and deploying personnel to perform RCA;
• undertaking RCA and identifying themes; and 
• monitoring the effectiveness of these RCA programmes.

Some observations and good practices in the RCA report will be appropriate for all audit firms, but many of the details will be more relevant to larger firms that wish to mature their RCA programmes. The FRC expects all UK audit firms to consider the report’s insights proportionately in the context of their nature and circumstance.

This article highlights some key messages and good practices that the FRC considers most likely to be useful to smaller firms.

Scoping RCA

When designing and implementing an RCA programme, the report lists factors for firms to consider in relation to scope, both firmwide and for audit engagement findings. 

When scoping RCA firmwide: 

• firms are required to perform RCA over all deficiencies in their SoQM; and
• should assess where RCA over other findings (such as exceptions in internal policies, processes and controls) would support identifying SoQM deficiencies.

★ Performing RCA for all ISQM 1 findings, and for a range of other firm-wide matters, to support assessment and remediation.

When scoping audit engagement findings:

• firms should consider where RCA would help assess if audit engagement findings and Prior Year Adjustments (PYA) indicate SoQM deficiencies;
• firms may consider where RCA over good practice points would aid proactive quality management; and 
• firms should be alert to changes in their circumstances that should impact the planned scope of their RCA.

★ Performing RCA for all PYAs impacting profit. Performing themed RCA over PYAs, such as adjustments to cash flow statements for ongoing audits.

★ Using structured mechanisms to track emerging issues in audit file findings and/or sub-populations, such as certain offices, business units or engagement leaders.

Resourcing RCA

The report also considers how those undertaking RCA are resourced, trained and allocated to projects. 

Firms are reminded that:

• for all RCA undertaken, firms should ensure relevant individuals have sufficient capacity, skills and experience, in line with the complexity of the RCA procedures; and
• where RCA is undertaken, firms should consider what reviews and oversight will support robust and consistent processes.

★ Using Audit Partner candidates to perform RCA and allocating them based on sector experience. 

★ Using an independent challenge panel to review all RCA results. 

Firms are reminded that training on technical matters, soft skills, behavioural and cultural factors can support RCA and the report offers insights into the variety of different ways that firms have approached this.

RCA timelines

Timing and deadlines for RCA can impact its effectiveness, in assessing deficiencies, accessing supporting information, and enabling timely completion of remediating actions.

• RCA for ISQM 1 deficiencies should be completed in time to support the annual SoQM evaluation;
• when planning RCA, firms should consider the need to identify deficiencies on a timely basis; and
• for audit engagement findings, this may mean planning RCA as soon as the findings are finalised.

RCA data gathering

Firms should assess what data would support each set of RCA procedures. This may include: 

• audit hours, levels of overtime, use of certain tools, or the timing of audit milestones; review of audit working papers;
• interviewing personnel from a range of grades and roles; and 
• questionnaires or surveys to gather a range of perspectives.

★ Using a range of approaches to structure interviews and challenge/corroborate insights that arise.

★ Developing/deploying RCA dashboards to track audit quality indicators and causal factors identified during audits.

The report considers various routes to data/information for RCA, such as interviews, focus groups and questionnaires that are being used by firms – and how to get the most from these. Helpfully, it also shares examples of specific questions that some firms are using for audit engagement RCA. 

For firms that are using a taxonomy to help them to categorise and track causal factors for audit engagement and/or firmwide findings, it offers some suggestions. These include:

• mapping categories of causes in the taxonomy to the quality objective and risks in the SoQM; and 
• balancing the benefits of granularity and aggregation and regularly reviewing and refreshing them.

Monitoring the effectiveness of RCA

Firms should assess the effectiveness of their monitoring processes to ensure they are meeting the requirements of ISQM 1. Firms should also consider whether their programmes are effectively identifying the drivers of quality outcomes and deficiencies in the SoQM. Where enhancements are needed, firms should assess the impact of any changes made.

Assessing the effectiveness of remediating actions can show whether root causes were appropriately identified and understood, and if the RCA is successfully supporting continuous improvement. Where actions were ineffective, firms should consider whether this was due to the incorrect root causes being identified, or remedial actions not being appropriately designed and/or implemented.

The report considers some ways that firms are assessing and monitoring the effectiveness of their RCA and offers some insights on getting the most from approaches such as gathering feedback from relevant stakeholders, periodic evaluation of RCA programmes, and using key performance indicators (KPIs). 

★ Setting KPIs for RCA. At one firm that does this, each KPI is scored 1-5 and for KPIs falling below 3, actions are planned to improve the process.

Proportionality in RCA

The nature, timing and extent of any RCA procedures are expected to be driven by a firm’s facts and circumstances, including its size and complexity, and by the nature and significance of the matters being analysed. The development of an RCA programme should be proportionate to the firm, the audit engagement and firmwide findings the firm is analysing.

As noted by the FRC in its report on ISQM 1-related RCA, smaller firms, or those undertaking more straightforward audits, may be applying RCA to less complex deficiencies and have SoQMs that reflect this. Therefore, their RCA procedures are likely to be less complicated and less formal.