Quality management standards: How to perform a root cause analysis
August 31, 2023
Editor's note: This article is the second in a series to help practitioners learn about the AICPA's new quality management standards and prepare to implement them.
The interrelated final standards on quality management issued in June 2022 by the AICPA's Auditing Standards Board and Accounting and Review Services Committee are intended to clarify and improve existing quality processes for audit and attest engagements. The new quality management standards require firms to adopt a risk-based approach to establish a system of quality management. Firms still have to institute policies, but the old process was more prescriptive and not as tailored to the nature and circumstances of the firm.
For an overview of the standards and what accounting firms must do to comply with them, review the first article in this series, "Quality Management Standards: How to Identify Risks and Design Responses." This article focuses on the monitoring and remediation process required by Statement on Quality Management Standards (SQMS) No. 1, A Firm's System of Quality Management.
SQMS No. 1 requires firms to design and implement a system of quality management tailored to their practices and engagements by Dec. 15, 2025. The system must be evaluated by firm leadership to conclude it is meeting its objectives by Dec. 15, 2026, and annually thereafter.
SQMS No. 1 introduces a new approach for firms with a focus on risks that may impact their engagement quality. A system of quality management includes eight integrated components.
The first component is a risk assessment process consisting of three steps: establishing quality objectives, identifying and assessing risks that could prevent achieving those objectives (quality risks), and designing and implementing responses to address quality risks. Firms are required to identify any need for additions or modifications to quality objectives, quality risks, and responses.
A separate component addresses the required enhanced process for monitoring and remediating the system of quality management. SQMS No. 1 shifts the focus of monitoring from the engagement level to the system-of-quality-management level. Firms should tailor their monitoring processes to firm-specific factors. The standard does not prescribe the monitoring activities, but it indicates that the process should provide relevant, reliable, and timely information about the design, implementation, and operation of the system of quality management, and that firms should take appropriate actions to respond to and remediate identified deficiencies on a timely basis.
Also, firms are required to inspect completed engagements and engagement partners on a cycle basis, with the firms determining which engagements and partners they select and how frequently.
"Firms are pushing hard to design and implement the core [system of quality management] components ," said Joe Lynch, CPA/CITP, Denver-based managing director and shareholder at Johnson Global Accountancy.
Firms will have policies and procedures in place, but based on his experience with firms implementing new processes and controls, Lynch projected there's a high likelihood some new procedures will fail when tested in the first year. The firms will then have to make changes to their processes and monitoring strategies.
Investigating the root causes of deficiencies
As part of the monitoring and remediation component, SQMS No. 1 requires firms to evaluate findings, identify deficiencies in the system of quality management, and evaluate how severe and pervasive the deficiencies are. That includes investigating the root causes of identified deficiencies.
The objective of the root cause investigation is for firms to understand the circumstances that cause the deficiencies so they can evaluate how severe and pervasive the deficiencies are and appropriately remediate them.
Firms may tailor and scale the nature, timing, and extent of their procedures to understand the root causes of deficiencies in relation to their circumstances and the nature and potential severity of the identified deficiencies. They are also required to design and implement remedial actions that are responsive to the results of the root cause analysis. Professional judgment is required, using available evidence.
The quality management standards define "findings" as "information about the design, implementation, and operation of the [system of quality management] accumulated from performing monitoring activities, external inspections, and other relevant sources, which indicates one or more deficiencies may exist."
"When firms look at findings from monitoring activities, they need to consider how the finding impacts the response that mitigates the risk," Lynch said. "The relationship could potentially be small and not relevant. Not all findings will be deficiencies."
According to the quality management standards, deficiencies exist when a quality objective is not established; a quality risk is not identified or properly assessed; responses do not reduce to an acceptably low level the likelihood of a related quality risk occurring because the responses are not properly designed, implemented, or operating effectively; or another aspect of the system of quality management is absent or not properly designed, implemented, or operating effectively.
"Deficiencies include both severity and impact, and severity could relate to likelihood of occurrence," Lynch said. "Firms need to consider what did happen and what could happen, including quantitative (number of engagements, financial results) and qualitative (image and integrity) impacts.
"Under the standard, if you identify a finding that does not rise to the level of a deficiency, you have the option to develop a remediation plan," he added. "You can choose not to do any root cause analysis on the finding, but you should look for common causal factors with other findings that may roll up to a deficiency."
Firms need remediation plans for all deficiencies that consider why the deficiency happened and may go beyond the area where it occurred. "A specific engagement matter may be caused by firm-level issues that the deficiency brought up, like a lack of firm guidance," Lynch said. "Remediation plans should be actionable."
SQMS No. 1 includes an example of an identified deficiency: A firm identified that audit engagement teams did not obtain sufficient appropriate audit evidence for accounting estimates when management's assumptions were highly subjective. The root cause could be lack of professional skepticism, or the deficiency could result from the firm having insufficient supervision and review of engagements or an environment that does not encourage engagement team members to question individuals with greater authority.
Ways to perform a root cause analysis
"Root cause methodology is not new. It has been used in many industries for years. It is a way to understand and document how things work, and it allows collective knowledge to come together," Lynch said. "Firms need a root cause analysis process that is iterative and not linear; they need to understand the problem, brainstorm why it happened, bring people together, and avoid functional silos."
SQMS No. 1 indicates that the root cause analysis should be performed by individuals assigned operational responsibility for the system of quality management. "This will vary by firm, but [the person] is usually a partner with deep experience with the firm's projects and audits," Lynch said. "For larger firms, this may be the partner in charge of quality, with a small- to medium-size team and a director or senior manager to execute this responsibility. The person should be a doer and influencer, with operational leadership experience."
The root cause analysis will also vary based on the size and complexity of the firm, he added. "In a small firm with a single office, a few partners, and a small staff, where everyone talks to each other daily, root causes will be more apparent, although the steps are the same as for larger firms. Mid-tier firms that specialize in certain audits or industries may have a part-time quality partner and may need to hire, reallocate resources, or go outside for help with root cause analysis. Larger firms must address multiple locations and different departments but have greater resources."
The standard provides that firms may use network services or a service provider to assist them with performing monitoring activities if firm personnel do not have the competence, sufficient time, and objectivity. Self-review threats may exist if individuals performing monitoring activities were involved in the engagements being monitored, and it may be more effective to have someone else inspect for compliance and propose remediation.
SQMS No. 1 calls for firms to look at their operating components and organizational structure, which goes beyond the performance of required quality control procedures in QC section 10, A Firm's System of Quality Control, which SQMS No. 1 supersedes. "Firms are continuing with their internal inspections at the engagement level and then expanding them to include areas that could be challenging for the firm overall, like resources, skill sets, and how they apply methodology," Lynch said.
What does a root cause analysis look like?
Lynch shared the following common example:
The engagement inspection process found that the engagement team failed to perform sufficient valuation procedures for fixed assets. To perform root cause analysis, the engagement team was brought together to find out what happened and why. The senior manager had not been involved in auditing fixed assets before, but the partner on the engagement had this experience. Questions asked were: Why was that senior manager assigned? Why didn't the partner supervise the senior manager? At a broader level, were there other causes, like lack of specific professional training, staff competence, workload, and staff assignment issues? Was the partner workload too great and the partner did not have time to supervise? If so, was this because there were economic pressures on the firm to take on more clients? Is the client acceptance process sufficient?
"Root cause analysis requires asking tough questions, and you need to go where the answers to questions take you and keep asking why," Lynch said. "Firms need to keep 'pulling the thread' and then other threads may be uncovered. There may be a need to fix the audit procedures at the engagement level, but there may also be bigger operational and human resource issues."
To identify root causes, he said, firms may need to gather firm data about engagements and staffing to give them a better perspective and enable them to ask better questions.
The system of quality management must be documented, including the results of the monitoring and remediation process and the root cause analysis. "The process must be objective so people don't feel they are being called out," Lynch said. "Interviews can be uncomfortable, and some firms may choose someone from another department or an outside person to do them."
The information obtained is put into the remediation plan so firms can check in the future whether process changes were made and what the results were.
SQMS No. 1 indicates that firms can also investigate the root causes of positive outcomes and use them to enhance their system of quality management. "The root cause analysis of why something worked can help firms repeat it and is an important opportunity for improvement," Lynch said. "In the example above, for the same client, if the senior manager had done a good job of auditing revenue based on applying experience gained from other clients, sharing that information within the firm and applying practices more broadly beyond the engagement could lead to putting better procedures or more training in place."
For Lynch, "the essence of the standard is all about moving from a reactive, control-by-control approach to a proactive approach. It is an enhancement opportunity to bring the power and knowledge of the firm together to improve the system of quality management and audit quality."
[Journal of Accountancy]
