As audit firms transition to the new quality management standards, they will need to embrace RCA. This article by Paul Winrow considers 12 questions to get you started on your RCA journey and heading in the right direction.
Root cause analysis (RCA) may be relatively new to many of those in the audit profession, but requirements in the International Standard on Quality Management (ISQM) 1 mean that we are all going to become more familiar with it. RCA is not something you can start overnight and get right first time. It is a journey, but one that will be worthwhile in the long run, as actions you identify will help to drive improved quality.
- What is RCA?
It involves looking at an outcome and identifying the true root cause of that outcome, positive or negative, rather than taking the first obvious and superficial cause as the reason something happened. It can be an extremely powerful tool when firms are looking to enhance audit quality. It can help address identified weaknesses more effectively and, equally importantly, can also be used to ensure good practices and behaviours are promulgated across the whole firm.
- How does RCA help?
Historically, whenever firms have had quality reviews or other events that identify issues to be addressed, the traditional response has been to provide more training. However, with those recurring weaknesses that come up time and again, clearly that training is not being truly effective. By undertaking RCA, you can get to the true root cause of the issues and, armed with that information, it is possible to identify more effective, varied responses to the issues arising.
It is still possible that training is the answer. However, it is more likely that a wider range of responses will be needed and they won’t always be short-term fixes –for example, changes to the firm’s methodology, guidance and templates, or longer-term fixes to address the firm’s resources or its culture around scepticism and challenge of management. Perhaps greater involvement of a Responsible Individual (RI) will be required at key stages in the audit. I have seen a situation where the root cause of an innocuous-sounding issue on an audit file ultimately led to a review of office-wide culture and stress management.
- Where do I begin?
When you are new to RCA the key is to get started, maybe in a small and straightforward way, and then learn as you go along. It is an iterative learning process and you will not get it 100% right first time, but that is fine. There are lots of things to think about, but the following questions are among those you will need to consider.
- What am I going to do RCA on?
This is a key question that needs answering upfront. Will you do RCA on all quality reviews, regardless of outcome, or just those files assessed as ‘failing’? Will you do RCA on the whole file review, or individual findings that are of most significance? Will you do thematic RCA on certain findings that arise across several reviews? There is no one-size-fits-all answer to this question – it will very much depend on the nature and circumstances of the firm and the extent of your quality review programme and findings.
- Who is going to do the RCA?
The key is that the RCA is undertaken by someone independent of the audit and ideally independent of the quality review, to ensure there are no pre-conceived ideas of the cause of any findings. In a follow-up article, we will explore resourcing of RCA either in-house or using external providers.
- What skill set is needed to undertake RCA?
An ability to challenge and discuss audit quality findings is the key attribute and, for smaller firms in particular, is most likely to be the key skill set that will be used in RCA. However, there are wider skills that can be useful and it may be appropriate to involve others from outside the audit practice. For example, professionals from other service lines may ask the ‘naïve’ questions that auditors take for granted, which may open doors to greater understanding. Introducing others with understanding of behaviours may also help identify/address some cultural matters. This needn’t be external, as most firms will have human resources expertise in-house. There are even examples of firms introducing skills from other industries that are more experienced in RCA (such as aviation) to bring RCA experience and a different perspective.
- Who should be involved from the team?
The entire engagement team should be involved in the process to ensure maximum benefit and that all views are aired. This may be achieved by, ideally, a full engagement team meeting, but depending on circumstances and the characters involved, it may be better to meet with members of engagement teams individually or in smaller groups. If there is a very dominant or senior RI, for example, staff that are more junior may feel uncomfortable.
- How do I go about it?
There are different ways of identifying root causes. These include the ‘Five Whys’ technique and the ‘Fishbone’ approach. The simplest means of identifying root causes, and likely the most appropriate for many firms, is to use the Five Whys model. This is basically an opportunity for the RCA reviewer to act like a toddler again and continually ask “Yes, but why?” until they get to the bottom of the issues at hand, by using each answer as the basis of the next question.
The extant ICAEW guide on RCA includes an example of how this works in practice.
- What about Audit Quality Indicators?
If your firm has developed Audit Quality Indicators, the information gleaned from these indicators will almost certainly be useful in the RCA. For example, analysis of time spent on an engagement by grade and stage of the audit may identify areas of focus.
- How do I identify actions to address root causes?
The article Action Planning goes into action-planning and evaluating success of remedial actions. The key for identifying actions is to ensure that they address the root cause identified. As mentioned earlier, it does not always require more training.
- Should I consider root causes of positive outcomes?
Absolutely! One of the great benefits of RCA is to identify those things that have gone well, understand why they went well and then put in place appropriate arrangements to ensure that these good outcomes, behaviours, practices, etc are replicated across all your activities. These may be as simple as an individual team or office developing a great template that they use to document, say, challenge of management/assumptions; the action may be as simple as then making that template available to everyone in the firm.
- How do I document the RCA?
There are some complex tools available on the market for documenting RCA outcomes, but it is not necessary to use a separate tool. Narrative documentation is equally appropriate and I have also seen Excel tools used where it is possible to characterise root causes/actions, placing them into different categories using Excel functionality. The key is to undertake RCA, identify better actions and ensure there is sufficient documentation. The documentation, like much of ISQM 1, should reflect the nature and circumstances of your firm.
Words of wisdom
I will leave you with some advice from someone with extensive experience of RCA in the military and in the nuclear power industry. When chairing a panel discussion on quality management, I asked what single tip they have for those implementing RCA for the first time. His answer was: “To keep control of the process and not to over-engineer it.” Sound advice from a man who certainly knew what he was talking about.
About the author
Paul Winrow, member of the faculty’s Technical and Practical Auditing Committee and Technical Partner at MHA MacIntyre Hudson
Audit & Beyond
This article was first featured in the February 2022 edition of Audit & Beyond.
