How to manage audit risk and improve your processes

This article was current at the time of publication.

Audit has been under increasing scrutiny from regulators, so it's no surprise that Root Cause Analysis (RCA) – a “connecting the dots” process of preventing faults by identifying the causes – is attracting attention from firms of all sizes.

The big end of town has been carrying out RCAs for some time, but smaller audit firms will find the process hugely beneficial, and not only for improving audit quality, but more importantly for detecting any underlying systemic issues.

RCA avoids the “putting out fires” approach to quality issues and allows firms time and breathing space to implement and improve the cost-effectiveness of the audit process, says new joint guidance on RCA implementation from CPA Australia and Chartered Accountants Australia and New Zealand (CA ANZ). An external auditor's guide to improving audit quality using root cause analysis (see below), developed on behalf of the Australian Auditing and Accounting Public Policy Committee, is a comprehensive and detailed step-by-step approach of the RCA process.

A case for remedial action

The guidance notes that every firm, regardless of size, should have internal inspections as part of its monitoring process. RCA is an efficient way to identify fundamental issues and take remedial action.

A case study shows how one small firm used RCA to discover it had an issue with the lack of engagement letters on file. Rather than sending out a flurry of letters at audit time, it decided to take a more thoughtful approach by asking the question “why is agreeing to the terms of engagement a requirement in the standards, and how can this benefit us?”

Consequently, the firm revised its annual planning process and scheduled staff to meet clients to discuss forthcoming work. The firm also addressed its fee structure and client expectations. While this process was initially lengthier than using the “putting out fires” tactic, ultimately it led to a more profitable and efficient process.

The RCA process does not have to be onerous or costly for smaller firms. It's a matter of starting small and scaling the process to suit the size of your firm. Even large firms initiated RCAs by starting small and scaling up.

The guidance maintains that firms thinking about implementing RCA processes should consider:

• It's not a choice to maintain audit quality, it's a requirement.
• RCA will improve audit quality in a cost-effective way, leading to superior services and sustainable profits.
• It can resolve multiple symptoms at once using one remedial action, instead of constantly putting fires out.
• Firms that perform RCA also discover better ways of doing things.
• If firms do not conduct a proper root cause analysis of inspection findings, audit quality will not improve and, over time, defects will become perpetual irritations.