As audit firms take steps to implement the new quality management standards, root cause analysis (RCA) will play a significant role. RCA will become one of the core building blocks in a firm’s continuous improvement efforts to ensure audit quality, and a firm’s ongoing response to RCA will become an important element of its overall system of quality management (SoQM).
This article focuses on identifying actions and developing a continuous quality improvement plan to address the causal factors that have come out of the RCA process for deficiencies and findings that have been identified as a result, for example, of monitoring, complaints and allegations.
There is no single method for undertaking action planning and every firm will determine how much time is needed to devote to the process. Some causal factors may need a lot of effort to resolve; others may be easier to fix. As always, the nature and circumstances of the firm and the situation will be the determining factor. The performance of a robust, continuous action-planning process often takes time because those involved need to dig deep in order to identify the potential root causes.
Identifying actions – who should be involved and why?
Regardless of who leads the RCA, it will always be important to include partners or other team members who are involved in the relevant findings or deficiencies, as they provide valuable information around the causal factors. In larger firms, it may be possible to engage with central support functions or with certain internal/external specialists, especially when considering cultural and behavioural factors.
In determining the most appropriate approach to action planning, it is useful to think about whether to:
- involve those who have undertaken the RCA in action development, as they have a good understanding of the issue and are therefore well placed to critique actions; or
- maintain the independence of action development and setting.
The important thing to remember is that every firm must determine the modus operandi that suits its own circumstances and the nature of the deficiencies that were identified. Whichever approach is adopted, it is important to engage with stakeholders across the firm and identify ‘owners’, and to agree appropriate timescales for remediation. As part of this process, it will be necessary to consider the level of reporting and communication required, which will also vary from firm to firm. Once this is identified, it will help to ensure the appropriate level of buy-in and support for action planning and ongoing monitoring.
Whatever approach is adopted, firms will also need to consider timing. For some firms, which may be conducting reviews on a rolling basis throughout the year, RCA never really ‘concludes’. Some deficiencies or findings may be sufficiently complex that there are a number of causal factors that need to be fixed, some of which may become apparent early on. In either of those circumstances, the firm may wish to spring into action as soon as possible (especially if the fix will take a long time, or if the causal factor is likely to continue to impact on engagements in progress).
In other situations, RCA may take place at a time when there are not many or any engagements taking place, and the nature of the causal factors identified may mean it makes sense to conclude the RCA process before moving to action planning.
Identifying the most appropriate action or actions
This can be a challenge. For some deficiencies, there may be multiple causal factors identified. Audits are increasingly complex and it might be necessary to have more than one action to address the underlying causal factors that may present differently from engagement to engagement.
An important consideration when identifying actions is to differentiate between the apparent causes (the symptoms) and the underlying causal factors. Action planning cannot start until a definite causal factor has been identified (regardless of whether the RCA process continues to strive to identify additional causal factors). There is a risk of ‘going too early’ and progressing to Action Plan stage – something that is not actually a causal factor, but rather just another symptom. If symptoms alone are treated instead of the root cause, the actions taken may not be sustainable or effective and the finding/deficiency may reoccur.
Even if the action plan process has not been started while the RCA is still ongoing, it is easy to fall into the trap of going for easy, quick-fix ‘solutions’ (that may not be a solution at all). Examples of quick-fix actions could be in the areas of training, guidance or updates to working papers, which are relatively easier to design and implement, but equally can result in a layering of actions that make it harder for auditors to execute or to see the wood for the trees.
However, there may be aspects of findings or deficiencies that can be targeted first before the underlying casual factors are identified. If there are scenarios where it is appropriate to tackle the initial causes or symptoms, it will be likely that a combination of actions is required to address the quick fix and the longer-term required change. In these cases, it is vital to step back and assess whether there is proportionate benefit in tackling the initial cause or whether time is better spent focusing on underlying causes.
A finding in a technical audit area may result in actions to update or improve working papers or guidance. However, it may also result in an action to improve auditor challenge or the articulation of that challenge on the audit file. A firm may have a culture change programme in place already that the RCA could feed into. This would result in one short-term action that is appropriate to take as soon as it is practically possible and one action that is associated with the ongoing longer-term actions on cultural change.
Action development and monitoring
Once actions have been identified and owners agreed, it is then important to define the success measures to enable subsequent and ongoing evaluation. Things to consider might be:
- Is the action specific enough?
- Is the owner the right person?
- Is it the right timescale with an appropriate deadline?
- Are similar actions in train already?
- What evidence will be available to assess whether it is complete?
- What are the criteria for success?
Consider again whether the actions are addressing a symptom or the underlying cause. Some actions will be easier to execute and to demonstrate they have been performed. Cultural and behavioural actions are more difficult to design and measure and will take longer to have an impact. Thinking about these points will help to ensure a clear and consistent framework for setting and monitoring completion of actions.
In some situations, recurring deficiencies relating to all or some of the same causal factors can be a fact of life. The question to ask is whether they are indicative of potential weaknesses in previous actions or have the issue or causal factors evolved? Monitoring the progress of actions regularly and implementing an action-effectiveness framework will enable firms to assess and respond to this. The effectiveness of action planning should be a specific consideration in the annual evaluation of the SoQM since action planning is part of the remediation component of the SoQM.
Action effectiveness – how do you know you have the right action?
In setting a framework for assessing whether the action is having the desired impact, you might consider:
- Have the actions been performed/completed?
- Can the impact on quality be demonstrated/measured?
- How will we measure ongoing and future impact?
- What evidence will be available? Consider both qualitative and quantitative sources.
Qualitative analysis could be carried out through direct conversations with people in the firm to understand if the action has had the intended effect. This could be a feature of ongoing RCA interviews.
Quantitative analysis is performed through analysing the results of internal monitoring reviews over time.
Where there are recurring deficiencies, findings or factors, it is important to understand why. It could be the finding or causal factor has evolved or narrowed, or perhaps the initial root cause did not get to the ultimate ‘why’ and we now understand more. This may mean the original actions will not be sufficient to address the causal factors.
It is also possible that external factors have had an impact, which means the action could not take effect – for example, due to COVID-19 actions that were designed for team interactions or in person may have had to be redesigned due to remote working. Finally, timing will also play a part where actions taken have not had time to embed fully or did not completely address the causal factor.
In order to understand what is driving the recurrence of deficiencies and findings, it will be essential to monitor the actions regularly to report progress and to assess ongoing impact.
A finding in an audit technical area may narrow year on year, so that the most recent finding is associated with only one element of the audit approach or audit test. This would indicate that previous actions were having an impact, but further action was required, or a change in planned actions, to address the remaining casual factor(s). In this circumstance, it would be beneficial to undertake additional RCA to better understand what is driving the remaining findings.
Layers of process
Action planning and measuring effectiveness is a multi-layered process with many nuances. Adequate time needs to be allocated at all stages with the right level of involvement from the right individuals to ensure maximum benefit for a firm’s SoQM.
About the author
Moyra Vipond, Senior Manager Audit Risk and Quality, PwC UK
Audit & Beyond
This article was first featured in the February 2022 edition of Audit & Beyond.
