Efficient capital markets are built on trust, and trust is built on verification. Investers trust the published financial statements of the companies they invest in because they trust the audits verifying the accuracy of such statements. Therefore, when audit quality shortfalls are discovered, rigorous and thorough analysis is required to understand how and why the breakdown occurred, as well as how to ensure it does not happen again. Root cause analysis is the means by which this is accomplished and is, therefore, a crucial component of any audit quality assurance program.

Root cause analysis may be a new concept to many in the audit community. This step-by-step guide provides a way to quickly get up to speed.

A root cause analysis is initiated upon discovery of a significant audit quality issue.  Whether the issue is “significant” or not can be based upon a defined set of threshold criteria, keeping in mind that each firm will likely have different thresholds. The following decision tree provides a conceptual example:

The root cause analysis process has five steps:

Gather and Manage Evidence

A root cause analysis should be evidence-based. Look for evidence in following areas:

• People

Who was involved, what roles did they play, and who else is knowledgeable about the event? Determine who should be interviewed and who should be on the investigation team. Choose those directly involved to participate as team members—they know the most about the event. However, make sure not to include anyone with an unresolved conflict of interest.

• Procedures & Documentation

Procedures govern the actions of people and are therefore an important source of information. What procedures were involved? Were they formal or informal? Were procedures followed? Were they accurate and complete?

• Systems

What systems were involved? What was their purpose and what role did they play in the event?

• Environment

What was the work environment during the audit? Was there schedule pressure? Was the client collaborative? Was there cohesion on the audit team? Did the team feel supported at each step?

Write the Problem Statement:

A problem statement is a one-page document that describes the problem being investigated, when and where the problem occurred, and the impact of the problem. Document both the actual and potential impacts. Also, be sure to document both the qualitative and quantitative impacts. For instance, a negative impression of the firm’s ability to produce a quality product is a qualitative impact. But the loss of a customer or an unplanned additional expenditure represent quantitative financial impacts. Both types should be documented.

Analyze Cause and Effect:

A cause and effect analysis builds a model of how the problem occurred. It starts with the Focal Point, which was documented in the problem statement, and deconstructs it into its preceding causes. We create a cause and effect diagram of the problem to help visually document the causes and their relationships. The easiest way to create the cause and effect diagram is by asking two questions:

1. What caused the effect?
2. Every time that cause occurs, will it always result in the effect?

The process works like this:

These steps are a good start but follow-up question to add additional clarity and detail are needed next. Is it true that every time an audit is delivered it lacks sufficient supporting evidence? No, of course not—the firm would not be in business long if that was the case. The audit had to be delivered AND the supporting evidence must not have met the minimum standard. The key to building an accurate cause and effect analysis is recognizing that effects are generally the result of multiple causes. A good way to show two or more causes working together is by using a logic diagram.

This should help the cause and effect make more sense. Each of these causes was necessary for the problem. And together, they are sufficient to describe how the problem happened.

These branches are very important in examining preceding causes. Why was the audit delivered? And why did the audit not meet the minimum evidence standard? This is how the chart looks when taken a few steps further.

Additional details make the picture clearer. Make no mistake—the above analysis requires additional work. Building a cause and effect diagram is an iterative process. But once complete, the chart will represent an accurate, evidence-based model of the problem. The cause and effect chart is an essential tool to identify and organize the causes and their relationships. And the process of building the chart is the same, regardless of problem type. It can even be used to identify the causes of events with positive outcomes, helping to replicate desired results.

Solutions

Solutions reduce risk by controlling causes. Any cause is a potential candidate for a solution, not just those at the end of a cause branch. In fact, a diverse set of solutions is desired to minimize the risk of recurrence. Just like a balanced investment portfolio, we manage risk through diversification by finding creative ways of controlling multiple causes.

Be sure the solutions offered will:

1. Be effective. Solutions need to control the target cause and break the causal chain.
2. Be implementable. It makes no sense to recommend a solution that cannot be implemented.
3. Provide a positive return on investment. Is there a solid business case to implement the solutions proposed based on the impact of the problem?
4. Solutions should not cause other problems. Consider how the proposed solutions could potentially impact others in a negative way. Anticipate potential negative impacts and adjust accordingly.

Challenge the investigation team to identify creative solutions that will reduce risk for everyone involved in future similar events.

Reporting

Finally, report findings in a consistent format. At a minimum, include the problem statement, a summary of the event (based on the cause and effect chart), a list of proposed solutions, a list of team members, and any remaining tasks. Be sure to assign each solution to a person along with a due date. Plan to follow up to ensure solutions are completed and working as intended. And be sure to share with others that could benefit from the RCA.

Closing

Audit quality issues are significant problems because they undermine trust.  These problems offer valuable learning opportunities that must not be overlooked. Conducting a root cause analysis is the best way for the organization to learn and improve. Root cause analysis is not difficult. With the right training, tools, and a bit of practice, competency can be achieved in a short period of time.