8 Characteristics of a Well-Designed Root Cause Analysis Process, According to the PCAOB

The Public Company Accounting Oversight Board released a staff report on Tuesday highlighting the importance of the root cause analysis (RCA) process in audit firms’ efforts to reduce mistakes made in their audits of public companies and ultimately to improve audit quality.

“RCA is an important procedure that many firms use to evaluate the adequacy of and compliance with their quality control system (QCS). We have observed that a firm’s deeper understanding of the underlying root causes of a deficiency can result in incremental improvements to a firm’s QCS and may drive further improvements in audit quality,” the report says. “We have observed that firms’ analysis of the root cause(s) has been helpful in determining the appropriate actions to remedy repeated or persistent criticisms from our inspections. The nature and extent of the root cause process will differ significantly based on a firm’s size and structural complexity.”

The PCAOB also noted that successfully performed RCA may be helpful to identify points in a complex process that can fail—either at the engagement level or within the QCS. In addition, RCA can highlight positive outcomes, the board said.

“As firms begin to better understand the drivers of positive outcomes, and the underlying drivers of quality, we expect that they will be able to drive their remedial efforts more effectively and proactively to improve audit quality,” the report states.

Based on observations during its various inspections of firms’ public company audits, the PCAOB has put together the following eight characteristics and effective practices of a well-designed RCA process that can contribute to improving audit quality—for firms of any size and/or structural complexity:

Dedicated team

Some larger firms use independent, dedicated teams with RCA experience to bring more objectivity to the process, including full-time or part-time senior-level professionals with relevant experience and background as well as professionals with expertise in behavioral fields. A diverse RCA team promotes multiple perspectives and drives an in-depth understanding of causal factors.

Smaller, less complex firms can also benefit by having an individual or team assigned to evaluate audit deficiencies periodically throughout the year, perhaps when methodology and process updates are incorporated into the firm’s audit practice.

Guidance and training

Some larger firms—that have internally developed audit methodology and processes—have also developed well-documented RCA guidance and processes for their professionals that provide insights and techniques in executing RCA procedures. This guidance promotes consistency, comparability, and accountability in the firms’ RCA processes. Firms also provide specific, targeted internal and external training to those responsible for causal analyses, develop multiple onboarding sessions, and provide on-the-job training by shadowing alongside other staff with more RCA experience.

Many smaller, less complex firms subscribe to a third-party service for their audit methodology and processes. The outcome of RCA can lead to a firm augmenting or tailoring the subscription methodology and processes for its specific audit firm needs. For example, augmenting or tailoring might include adding an internally developed template for certain financial statement accounts or customization of generic audit programs for an engagement or engagements in a particular industry. These firms can benefit from RCA by assigning an individual or team to specifically be responsible for communication of updates and interpretation of the methodology and processes to the firm’s audit practice professionals.

Data gathering and tools

Some firms use a variety of techniques to gather information for the RCA, including:

• Interviews with the engagement team immediately after the deficiencies are identified and/or after some passage of time to provide the audit team members some degree of perspective and less emotion or personal bias;
• Review of the engagement team’s time and training records;
• Review of audit workpapers;
• Review of audit metrics or data (such as milestones, realization rates, or engagement team member’s individual years of experience); and
• Use of software and proprietary tools to effectively analyze and evaluate large amounts of data.

The PCAOB said it observed firms using third-party software tools for qualitative and quantitative research, analysis and evaluation of interview responses and observations from workpaper reviews, and for tracking other related data. The board also observed the use of proprietary tools to capture data such as causal factor categorization, severity assessments, and action plans. The use of these technology tools may increase the effectiveness and efficiency of the firms’ RCA processes.

Smaller, less complex firms can benefit by having an assigned individual or team track and evaluate identified deficiencies across their audits to understand whether applicable guidance, templates, and/ or training may need to be modified or augmented.

Scope

Some firms analyze both negative and positive quality events. The PCAOB said it observed firms compare the results of their analysis of positive quality events to those audits with deficiencies, which help inform the firm of potential actions to continuously improve audit quality.

Level of analysis

Some firms are analyzing both individual deficiencies at the engagement performance level and also considering a broader assessment, such as topical trends or deficiencies related to specific guidance or aids, to inform improvements in their QCS.

Prioritization

Firms are prioritizing RCA efforts on areas determined to pose the highest risk to the firm and/or to the financial statements being audited. Some firms are focusing their detailed analyses on material restatements and collectively analyzed the remaining restatements for trends, according to the PCAOB. In addition, certain firms are prioritizing and categorizing causal factors based on weightings and exception types, or deficiency types. Focusing efforts on higher-risk areas ensures that firms spend their time and resources on areas likely to have the most impact. Notwithstanding higher-risk areas, some firms also prioritize efforts on pervasive or broadly applicable areas that affect more audits.

Conclusions

The PCAOB said it observed that some firms’ RCA conclusions involved collaboration among various groups within the firm. In addition to the engagement team, the firms’ RCA conclusions are generally determined by internal quality monitoring groups, professional practice personnel, regional leaders, and audit methodology personnel.

In smaller firms, the individual or team responsible for methodology and process updates could perform this role, perhaps in combination with their coordination of new training for updates to the methodology and processes.

Monitoring remedial actions and reporting

At some firms, monitoring involved collaboration among various process owners and groups such as audit leadership, professional practice, and internal inspections to provide oversight of the design, implementation, and monitoring of remedial actions responsive to the identified root cause. Certain firms create monitoring groups or task forces comprised of individuals from various groups to monitor specific remedial actions related to frequently occurring findings, according to the PCAOB. Firms are also providing firm leadership with annual reporting of audit deficiencies, causes of systemic or episodic findings, related corrective actions, preventive measures, and monitoring of results. When deficiencies recur, firms reassess the prior RCA to consider new facts or omissions.

In smaller firms, periodic discussion during leadership meetings or even audit staff meetings might accomplish the same result.