Root Cause Analysis (“RCA”). It’s been a hot topic buzzing around auditors and audit regulators the world over for the past couple of years. Universally, it is recommended as a best practice, but is it actually required? Currently, it is not; at least not under PCAOB auditing standards. However, that may all change in the near future.
In December of 2019, the PCAOB published its quality control concept release which discusses various proposals and ideas around how it could update and improve its QC standards. The concept release is built on the foundation of International Standard on Quality Management 1 (ISQM 1), Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements, as proposed by the International Auditing and Assurance Standards Board (IAASB). Each element of ISQM 1 is summarized and then the PCAOB adds additional language that clarifies what aspects of ISQM 1 it intends to adopt, along with changes or additional guidance it may propose in a future QC standard.
The concept release touches on various QC aspects, but perhaps most interesting is the potential requirement for firms to perform both a root causes analysis (RCA) and remediation procedures. These considerations fall under the monitoring element within the PCAOB’s QC framework. The current standard, QC 30, Monitoring a CPA Firm’s Accounting and Auditing Practice, provides a loose framework for inspections and provides limited guidance.
The proposal in ISQM 1 continues to require internal inspections of engagements but it would also introduce the requirement to perform root cause analyses and remediation procedures for all inspection findings. The PCAOB expects to have analogous requirements in future QC standards. Specifically, the PCAOB indicated:
“A firm’s responsibilities under Proposed ISQM 1, together with potential incremental or alternative requirements, if any, would differ in two respects from the existing process for remediating QC deficiencies identified in PCAOB inspections. First, the potential requirement would apply to identified QC deficiencies from internal and external sources, not just those cited in PCAOB inspection reports. Second, the potential requirement would impose a presumptively mandatory obligation to design and implement remedial actions to address QC deficiencies…” 1
This not only requires that firms perform an RCA for both internal and external inspection findings, but also that firms remediate the deficiencies identified as part of the RCA.
Through our work with firms, including help with pre and post-issuance inspections as well as assisting firms with root cause analyses, we have identified a number of important areas for consideration in a RCA. Areas of concerns included:
The root cause process often involves reading through workpapers related to the identified audit deficiencies, followed by a brainstorm session with the engagement team (managers and partners) and often members of the firm’s national office to flush out potential root causes and better understand the unique considerations specific to the engagement. While it may be easy to point to one “main” root cause, such as engagement turnover, we have found that upon more thoughtful consideration, there are often multiple contributing root causes to any one deficiency. Thus, it’s important to keep asking “why?” and to dig deeper into the possible root causes for a holistic perspective. It is also important to create an open dialogue during these interviews so that these discussions do not become a “blame game.” Asking members independent of the engagement to perform the interviews also gives the engagement team members the opportunity to speak honestly. Aggregating these various perspectives will enable firms to thoughtfully conclude on the real root causes.
Adding the requirement to also remediate identified deficiencies will take the inspection process, whether internal or external, through to completion. While the remediation requirements may be less robust than what is currently required for a PCAOB remediation submission, the requirement for remediation for all identified deficiencies will force firms to create new QC processes and will require additional time and effort.
The PCAOB has continued to emphasize the importance of QC systems and its intention to focus more on this area in future inspections. It will be interesting to see how the new QC standard(s) evolves. Once released, we will be curious to see how the PCAOB plans to monitor the implementation of the new standards within firms and how the PCAOB will measure its overall effectiveness in improving audit quality. Firms that fail to comply with the new standards, may have to do a root cause analysis to understand why they failed to implement a root cause analysis in their QC policies and procedures. Oh the irony!
Dane Dowell is a Director at Johnson Global Accountancy who works with PCAOB-registered accounting firms to help them identify, develop, and implement opportunities to improve audit quality. With over 12 years of public accounting experience, he spent nearly half of his career at the PCAOB where he conducted inspections of audits and quality control. Dowell has extensive experience in audits of ICFR and has worked closely with attorneys in the PCAOB’s Division of Enforcement and Investigations. Prior to the PCAOB, he worked with asset management clients at PwC in Denver, Singapore, and Washington, D.C.
1 PCAOB Release No. 2019-03. Concept Release – Potential Approach to Revisions to PCAOB Quality Control Standards. December 17, 2019.
Johnson Global Advisory
1717 K Street NW, Suite 902
Washington, D.C. 20006
USA
+1 (702) 848-7084