Monitoring and remediation: findings, deficiencies and root cause analysis

• Design monitoring activities based on the factors in QM 10.38
• Select completed engagements for inspection under QM 10.39
• Distinguish findings from deficiencies and evaluate severity and pervasiveness
• Investigate root causes and evaluate remedial actions

Purpose

The monitoring and remediation process provides relevant, reliable and timely information about the design, implementation and operation of the system, and responds to identified deficiencies so they are remediated on a timely basis (QM 10.36). It is how the firm knows whether its responses work.

Designing monitoring activities

The firm designs and performs monitoring activities to provide a basis for identifying deficiencies (QM 10.37). In deciding their nature, timing and extent, it takes into account (QM 10.38): the reasons for the risk assessments, the design of the responses, the design of the risk assessment and monitoring processes, changes in the system, the results of previous monitoring and whether remediation worked, and other information such as complaints, external inspections and information from service providers.

Monitoring activities include in-process reviews of engagements, testing of specific responses (for example, the annual independence confirmations), and the inspection of completed engagements.

Inspection of completed engagements

QM 10.39 requires inspection of completed engagements as part of monitoring. The firm decides which engagements and partners to select, taking into account the QM 10.38 factors and other monitoring activities, and must select at least one completed engagement for each engagement partner on a cyclical basis the firm determines. The standard does not fix the cycle length; the firm sets it based on risk. Inspectors need competence, capabilities and time, and policies must address their objectivity; objectivity is enhanced when engagement team members and the engagement quality reviewer do not monitor their own engagement (QM 10.40).

Findings versus deficiencies

A finding is information from monitoring, external inspections or other sources that indicates one or more deficiencies may exist (QM 10.17). A deficiency exists when a required quality objective is not established, a quality risk is not identified or properly assessed, a response does not reduce a risk to an acceptably low level because it is not properly designed, implemented or operating, or another aspect of the system is absent or not working so that a requirement is not addressed (QM 10.17).

The firm evaluates findings to determine whether deficiencies exist, including in the monitoring process itself (QM 10.41). Not every finding is a deficiency: a single documentation lapse with no pattern may be a finding only.

Root cause and severity

For identified deficiencies, the firm evaluates severity and pervasiveness by investigating the root causes, with procedures scaled to the nature and possible severity of the deficiency, and by evaluating the effect of the deficiencies individually and in aggregate on the system (QM 10.42). Root cause analysis asks why the response failed: training, time pressure, a template error, unclear policy, or a cultural issue. The root cause analysis guide and the root cause template give methods such as five whys and fishbone diagrams.

Remediation

The firm designs and implements remedial actions responsive to the root cause (QM 10.43). The individual responsible for monitoring evaluates whether the actions are appropriately designed and implemented and whether actions for prior deficiencies were effective (QM 10.44), and takes action if they were not (QM 10.45). When a finding indicates required procedures were omitted or a report may be inappropriate, the firm takes action to comply with standards and, if the report is inappropriate, considers the implications, including legal advice (QM 10.46).

The monitoring leader communicates the activities, deficiencies and remediation to the individuals with ultimate and operational responsibility (QM 10.47), and the firm communicates them to engagement teams (QM 10.48).

Common implementation problems

• Inspection is the only monitoring activity.
• Partners skipped in the cycle for years.
• Findings counted but never evaluated for deficiencies or root cause.
• "Retrain staff" as the remedy for every deficiency.

Lindqvist & Ames CPAs: from findings to a deficiency