Root cause analysis: applying the five whys

Root cause analysis is a common tool audit firms use to understand where enhancements can be made to improve audit quality. Some audit firms use external resources to perform root cause analysis, while others may develop in-house capability and experience.

Several different methods can be used when performing root cause analysis. Within audit firms, these commonly include:

• the five whys, which involves repeatedly asking why an issue occurred to identify its underlying cause;
• the fishbone, which helps identify and categorise potential contributing factors; and
• fault trees, which use a logical, top-down approach to trace the causes of an issue.

This article illustrates how the five whys method - originally developed by Toyota - can be used to identify the root causes of an audit quality finding and how those causes can be used to evaluate whether there is a potential deficiency in the System of Quality Management (SoQM).

The five whys

This method involves asking engagement teams ‘why?’, usually at least five times, when seeking to understand the root cause that led to an outcome or issue. The repeated questioning helps to drill down beneath the symptoms of the issue to identify the underlying causes that led to it. Each answer forms the basis of the next question, helping audit firms move beyond surface-level symptoms to uncover the real drivers of audit quality.

The five whys is a simple, cost-effective method that can be adapted to most audit quality issues including engagement inspection findings, deficiencies in the SoQM, indicators of potential deficiencies as well as good practices and audit behaviours.

Despite its name, the number five is not a rule. It is possible to reach the root cause in less than five questions, and it can take more than five in other cases. What is important is reaching a cause that, when remediated, prevents the problem from re-occurring.

When using the five whys method the focus should be on the specific answers to the question asked. It is important not to start thinking of solutions until the analysis is complete, as this may result in a failure to identify all relevant root causes.

In this example, one of the root causes identified was that the workload monitoring control for the partner was not frequent enough to identify necessary adjustments to the workload arising from unplanned events. When aggregated with other root causes of engagement findings and SoQM monitoring results, it may become clear that this cause contributed to several findings, indicating a potential weakness in the SoQM requiring remedial action. If no similar causes are identified, remedial action may only be required at the engagement level and not in the SoQM.

Although a simple method to use, the example illustrates that the five whys can be an effective way of identifying multiple causes of engagement inspection findings, some of which when aggregated can help firms identify where to focus remedial actions.

Identifying the remedial actions: who should be involved and why?

There are different ways to implement the remediation process. These depend on the firm's nature and circumstances, the nature and scale of the finding or deficiency, the significance of the root causes, and whether the matter has recurred. It is important to allow enough time for this process and to engage early with stakeholders across the firm, including support functions across the SoQM, where they exist.

The five whys example above shows that root cause analysis is not linear. While the most significant root cause was the frequency of the monitoring control, several other causes impacted audit quality, such as the quality and availability of coaching and the timeliness of manager review, which the firm may want to address. Root cause analysis may therefore identify multiple root causes, each of which should be assessed individually to determine the extent of remediation required. Involving those who have undertaken the root cause analysis is therefore often a good start as they have a good understanding of the findings and causes and are well placed to design and/or challenge the remedial actions.

The next step is to identify action ‘owners’, to agree on the overall objective of the action and an appropriate timescale for remediation. As part of this process, it is useful to consider the level of ongoing reporting and communication that will be required, which will also vary from firm to firm. Once this is identified, it will help ensure the appropriate level of buy-in and facilitate action planning and monitoring.

Monitoring effectiveness

Once actions have been identified and owners agreed, it is important to define the success measures to support monitoring and remediation. Questions to consider might include:

• Does the action have an appropriate timescale with an appropriate deadline?
• What do success and effectiveness look like, how will we measure them, and what evidence will we need to do that?
• How frequently will progress be checked (thinking about the short and longer term)?

Effectiveness measures

Qualitative analysis could be carried out by having direct conversations with audit teams to understand if the action has had the intended effect. This could be via focus groups, through feedback from live file reviews or as a feature of ongoing root cause analysis interviews. 

Quantitative analysis is performed by setting measures and performing trend analyses using difference data sources, allowing effectiveness to be monitored over time. These could include quality metrics the firm is already monitoring, for example relating to engagement type, industry, people and ethics, or specific data points that relate to action areas including feedback on training or people surveys.

Responding to the five whys example

In the five whys example, a potential SoQM finding has been identified. The control to monitor the partner’s workload was not operated frequently enough to identify necessary workload adjustments because of unplanned events. Remedial actions might include increasing the frequency of the control, and/or introducing a process to flag unplanned events or changes to workloads to trigger a one-off assessment of a particular partner’s workload.

While the ultimate measure of success might be looking at whether the findings repeat in the next cycle of reviews or inspections, it is important to think about how to measure the impact of the actions taken in the short or medium term.

In this example, we assume that the control to monitor workload is increased from yearly to every six months. It might be appropriate to look at the available data for the first six months to ensure that monitoring happened, what was considered and if any adjustments were made as a result. Or it may be more appropriate to have individual check-ins, or to get feedback from partner focus groups on whether the control covers the type of unplanned events that they would expect.

All of these taken together will allow conclusions to be reached about the effectiveness of the remedial actions taken.

Cheryl Powick, Director, UK Audit Quality and Risk, Deloitte LLP 

Moyra Vipond, Director, UK Audit Risk and Quality, PwC