Fixing the file that failed an inspection is not remediation. SQMS No. 1 asks the firm to find out why the failure happened and to fix that. Paragraph 42 requires the firm to evaluate the severity and pervasiveness of identified deficiencies by investigating the root causes, and evaluating the effect of the deficiencies individually and in aggregate on the system. Paragraph 43 then requires remedial actions that are "responsive to the results of the root cause analysis."
Root cause analysis sits in the middle of the monitoring and remediation process. For the full process, see monitoring and remediation under SQMS 1.
What the standard says a root cause analysis is for
The application material states the objective: to understand the underlying circumstances that caused the deficiency, so the firm can (1) evaluate its severity and pervasiveness and (2) appropriately remediate it (A181). It describes the analysis as an exercise of professional judgment based on the evidence available.
Both purposes matter. A deficiency that looks like a one-off documentation lapse may trace to a cause that touches every audit, which changes its pervasiveness and therefore the conclusion in the firm's annual evaluation. And a remedy aimed at the symptom, such as reminding staff to complete a form, will not prevent recurrence if the cause is that the form is not in the template.
Scale the effort to the deficiency
Paragraph 42a says the nature, timing and extent of the procedures depend on the nature of the deficiency and its possible severity. The application material (A182) adds the firm's own characteristics:
- Size, complexity and dispersion. In a less complex firm with a single location, the analysis may be simple because the information is readily available and concentrated and the cause may be more apparent. A multi-location firm may need trained people and a formal methodology.
- Nature of the deficiency. The analysis is more rigorous when an inappropriate audit report was issued, or when the deficiency relates to leadership's actions and behaviors regarding quality.
- Possible severity. It is more rigorous when the deficiency appears across several engagements or when policies show high rates of noncompliance.
A one-partner finding about a missing independence confirmation can be resolved with a short written analysis. A pattern of insufficient evidence on estimates across audits needs a documented investigation.
Techniques that work in a small firm
The standard prescribes no technique. These steps fit its description.
- Describe the deficiency precisely. State what objective, risk or response failed. Use the standard's categories: an objective not established, a risk not identified or properly assessed, a response not properly designed, implemented or operating, or another aspect of the system absent or not working.
- Gather the facts. Pull the affected files, the firm's relevant policy, the template used, the training records and the staffing for each engagement. Interview the people involved.
- Ask why repeatedly until the answer is something the firm controls. "The senior did not document the review" is a fact. "The template has no prompt for the review and the manager's checklist does not cover it" is a cause.
- Test the cause against other engagements. See below.
- Write the cause in one or two sentences and link it to the quality risk and response in the risk register.
Contrast with engagements that did not fail
The standard says the firm may consider why deficiencies did not arise in similar circumstances (A183). Its example: findings occurred across multiple engagements, but not in several others in the same population tested. By contrasting the two groups, the firm concludes the root cause is a lack of appropriate involvement by engagement partners at key stages.
In practice, that means comparing the failing audits and the clean audits on staffing, partner hours, timing of review, template version and client characteristics. If every failing file had its partner review in the final week and every clean file had interim partner review, the cause is not the staff.
The standard also notes the firm may investigate the root causes of positive outcomes, which may reveal opportunities to improve the system (A185). A partner whose files never produce findings is an information source.
Write causes specifically
Specific causes support specific remediation (A184). The standard's example: engagement teams are not obtaining sufficient appropriate audit evidence on accounting estimates with highly subjective assumptions. The firm notes a lack of professional skepticism. The underlying cause may relate to a cultural environment that does not encourage team members to question people with greater authority, or to insufficient direction, supervision and review.
"Lack of skepticism" is a description of the finding, not its cause. The cause sits one level lower, and the remedy follows from it: a firm that finds the culture problem coaches partners on inviting challenge, while one that finds a review problem changes who reviews estimates and when.
Illustration
A firm's inspection finds that three of five audits lack documentation of the evaluation of design and implementation of controls over journal entries, which AU-C 315 as revised by SAS 145 requires for controls over journal entries and other adjustments. See SAS 145 documentation.
- Weak cause: "Staff did not follow the template."
- Better analysis: the template, built before SAS 145, has an internal control section organized around the old control risk assessment and has no field for journal entry controls. The two clean files were prepared by a manager who added the section by hand. The cause is a template that was not updated when the standard changed, which is a failure in the resources component (intellectual resources) and in the process for identifying changes in standards.
- Remediation: update the template, retrain, inspect the next audits prepared with it, and add a standards-change review to the annual calendar.
Severity, pervasiveness and aggregation
The analysis feeds the evaluation of severity and pervasiveness. The factors in A179 include the aspect of the system affected, whether compensating responses exist, the root causes, the frequency of the matter, and its magnitude and duration. The standard says evaluating findings, identifying deficiencies, evaluating severity and investigating root causes is an iterative and nonlinear process (A177). A root cause analysis can show that findings previously judged not to be deficiencies share the cause and should be reclassified.
Paragraph 42b requires evaluating deficiencies individually and in aggregate. Several small deficiencies with one root cause may be more serious together than apart.
When the cause is a service provider's
If the root cause relates to a resource from a service provider, the firm may consider whether to continue using it or communicate the matter to the provider. The firm is responsible for addressing the effect on its system and preventing recurrence. It is not ordinarily responsible for remediating the deficiency on behalf of the provider or investigating the cause inside the provider (A188). See network requirements and service providers.
What to document
Paragraph 59d requires documentation of the evaluation of findings, the identified deficiencies and their related root causes. A one-page analysis per deficiency, with the facts reviewed, the cause, the severity and pervasiveness reasoning and the remedial action, meets it for most small firms.
Frequently asked questions
Is root cause analysis required for every finding?
It is required for identified deficiencies. The firm first evaluates findings to decide whether they are deficiencies (paragraph 41). The depth of the analysis scales with the deficiency's nature and possible severity.
Can the same person who did the work analyze the cause?
The standard's objectivity requirement applies to people performing monitoring activities (paragraph 40). Using someone not involved in the engagement or process improves the quality of the analysis.
Sources
- AICPA, Statement on Quality Management Standards No. 1, A Firm's System of Quality Management (June 2022), paragraphs 40 to 43 and 59 and application material A174 to A188
- AICPA, Statement on Auditing Standards No. 145, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement (October 2021), AU-C 315 as revised
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Quality management and practice: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error