Root cause analysis (RCA) provides audit firms, regulators, policy makers and practitioners the opportunity to learn from past adverse events and prevent them from reoccurring in the future, leading to better audit quality. Recently approved regulations (ISQM1) make RCA mandatory for certain adverse events, making it essential to learn how to properly conduct an RCA. Building on the findings and recommendations from the RCA literature from other industries where RCA practice is more established such as the aviation and healthcare industries, audit firms can implement an adequate and effective RCA process. Based on the RCA literature, I argue that audit firms would benefit from a systems-based approach and establishing a no-blame culture.

root cause analysis, audit firms, systems thinking, no blame culture

Audit firms can use the insights from other professions to effectively establish an RCA process. Furthermore, the paper informs the audit profession on the developments regarding RCA.

Root cause analysis (RCA) is the process of identifying the causes of adverse events (e.g. inspection findings, audit failures, restatements, litigation) and preventing these root causes from happening again in the future (e.g. Leveson et al. 2020; Percarpio et al. 2008; Wu et al. 2008). Recently adopted regulations mandate that audit firms establish RCA procedures and identify remedial action to prevent the root causes from reoccurring (ISQM1, IAASB 2020).¹ The standard will come into effect on December 15, 2022. ISQM1 describes the main objective of RCA as understanding the underlying circumstances² or attributes causing the adverse event. These attributes can be linked to prior research on audit quality through the audit quality indicators (AQI’s) (DeFond and Zhang 2014; Francis 2011; Knechel et al. 2013). The AQI’s may lead to relevant areas where root causes can be examined and, vice versa, identified root causes might lead to AQI’s (AFM 2017; PCAOB 2014). Several audit firms review AQI’s as part of the RCA, such as the number of audit hours, partner tenure, and percentage of partner time, as these aspects are known to influence audit quality and may help to identify the root cause (FRC 2016). When root causes are identified, the current literature on AQI’s can help identify proper remedial action (Nolder and Sunderland 2020). For example, prior research shows that critical thinking can be improved by prompting a deliberative mindset (Griffith et al. 2015) or a systems-thinking perspective (Bucaro 2019). Literature from other professions, such as healthcare and aviation, show that linking safety or quality indicators to the RCA also benefits system-wide learning (Chang et al. 2005; O’Connor and O’Dea, 2007; Taitz et al. 2010; Wiegmann and Shappell 2001).

The purpose of this article is to provide insight in the background of RCA and RCA practice in the audit profession. It is important to gain more insight, as RCA provides audit firms the opportunity to learn from past adverse events and prevent them in the future. Regulators find that in investigating adverse events audit firms do not reach the level of depth needed to identify the root cause (AFM 2020; FRC 2016; Nolder and Sunderland 2020). Gaining more insight in the context, or system, in which the root causes emerged would provide a more in-depth understanding. Organizations form complex systems, consisting of underlying relationships between humans, technology and their surroundings (Grant et al. 2018). If the system in which the adverse events emerged is not altered, more adverse events are likely to occur (Dien et al. 2014; Labib 2015).

Furthermore, to conduct a valuable RCA, a safe environment is needed, where those involved with the adverse event feel free to speak up (Iedema et al. 2006; Wu et al. 2008). I find that audit firms should provide more clarity on how RCA findings could impact the individuals involved in the adverse event, to encourage a safe environment and no-blame culture. Those involved might be reluctant to be open about their experience when their openness could lead to disciplinary, legal or institutional actions, resulting in possibly missing essential insights.

In the second section of this paper I describe the RCA process. In the third section, I elaborate on the use of RCA in other professions, after which I reflect on the current situation of the audit profession. In the fourth section, I conclude with a summary.

The RCA process aims to understand why an adverse event came about (e.g. Bagian et al. 2002; Benner 1975; Percarpio et al. 2008). As noted, examples of adverse events in the audit profession are litigation, audit failures, inspection findings, or restatements. Generally, the RCA process consists of five separate steps: defining the problem; collecting the data; analyzing the data; identifying root causes; and identifying remedial action (Mahto and Kumar 2008; Percarpio et al. 2008; Rooney and Vanden Heuvel 2004). To conduct these steps, the audit firm needs to appoint an investigation team, to which I refer as the RCA team.

Using an example from audit practice, I illustrate the steps outlined above, starting with what happened – defining the problem. A regulatory inspection finds that the auditor failed to sufficiently assess and challenge the assumptions in the cash flow forecasts of X’s management for the audit of the goodwill impairment.³ The problem definition for the ensuing RCA could be formulated as: the audit of the goodwill at X failed to meet the standards (obtaining sufficient appropriate audit evidence – ISA 200.17 and ISA 540). To investigate how this happened, the RCA team could review the working papers regarding goodwill, to gain insight on the work done or, to be more accurate, the work documented – collecting the data. Data on the planning on the engagement (planned and worked hours) provides information about the audit team’s capacity and helps to contextualize the issue. Furthermore, the RCA team conducts interviews with the engagement team and involved specialists, to learn about the adverse event’s circumstances and the perceptions of those involved. After the data is gathered and the interviews are conducted, the RCA team analyzes the observations - analyzing the data. There are several (qualitative and quantitative) tools that can be used to analyze the data and formulate causal factors (possible contributors to the adverse event).⁴ In the case of the goodwill impairment, identified causal factors can be, for example: high workload, no coaching on the job, insufficient training, or lack of professional skepticism. After the data are analyzed and visualized, the RCA team drills the causal factors down to the underlying roots of the adverse event – identifying root causes. The main objective of this step is to distinguish the symptoms from the actual root causes, since merely addressing the symptoms would not prevent the problem from happening again (Mahto and Kumar 2008). Let’s assume that the engagement team failed to gather counter evidence on the management assumptions. The root cause of this problem could be a ‘check the box’ mentality triggered by the use of extensive checklists in the audit guidance.⁵ When the root causes are properly identified, measures are formulated to prevent the adverse event from reoccurring (Percarpio et al. 2008; Wu et al. 2008) – identifying remedial action. The literature on AQI’s can help with formulating appropriate remedial measures. For example, measures to trigger a deliberative mindset, leading to a considerate or skeptical state (Griffith et al. 2015) or decision aids prompting a systems-thinking perspective, leading to a more holistic approach of an organization’s business processes (Bucaro 2019).

This section explores the RCA literature from other industries where RCA is a more established phenomenon, aviation and healthcare. This review reveals two promising practices which are relevant for the audit profession, namely systems thinking and a no-blame culture.

RCA aims to answer the questions of why an adverse event occurred and how to prevent re-occurrence (e.g. Leveson et al. 2020; Percarpio et al. 2008; Wu et al. 2008). RCA also helps in determining the drivers of the quality of the audit (ISQM1, IAASB 2020), and strengthening the AQI’s in doing so. RCA is conducted by defining the problem; collecting the data; analyzing the data; identifying root causes; and identifying remedial actions (Mahto and Kumar 2008; NBA 2019; Rooney and Vanden Heuvel 2004).

Literature from other professions with more established RCA practices argue the importance of a systems approach and the need to comprehend the complex system in which adverse events occur in order to acquire the level of depth needed to understand the root cause and to be able to properly identify remedial actions (e.g. Besnard and Hollnagel 2014; Leveson 2004; Peerally 2016; Rasmussen 1997). RCA tools tend to be based on linear models, which can lead to a reductionist view, where the reality is more complex and system failures remain unaddressed. The linear narrative could also lead to the search for ‘the one fundamental root cause’ (Wu et al. 2008). Since RCA in audit practice often does not acquire the level of depth needed (AFM 2020; Nolder and Sunderland 2020), the use of system-based RCA tools might prove beneficial. Furthermore, within the audit profession, RCA focuses on a single organization, rather than the collaborative system (e.g. global networks, clients and regulators). Without addressing the collaborative systems, system-wide learning for the auditing profession is not established. Furthermore, the root cause and remedial action might be insufficient or aimed at the wrong level of the system (Wu et al. 2008).

Avoiding blame is important for the RCA process, as it prompts those involved to speak up during the RCA, optimize learning, and create a safe learning environment (Iedema et al. 2006). However, several factors promote a blame environment: hindsight bias, leading to being overly critical to those involved (Fischhoff 1975); possible disciplinary, legal or institutional actions (Dempsey 2010; Peerally et al. 2016); and blame seeking tools (Livingston et al. 2001). In this regard it is important to establish independent, multi-disciplinary expert teams, with a clear distribution of responsibilities regarding disciplinary, legal or institutional actions. The RCA practice in the audit profession is internally organized within each audit firm, leading to risks regarding its independence. Furthermore, there is a lack of clarity regarding the possible concurrence with the RCA and disciplinary, legal and institutional actions. The audit profession needs to further investigate how the possible independence issue, and the confusion regarding personal consequences for those involved with the adverse event, can be mitigated.

I would like to thank Chris Knoops and the three anonymous reviewers for their comments and feedback. Furthermore, I want to thank Anna Gold, Herman van Brenk, Dominic Detzen, Arnold Wright, Tjibbe Bosman, Frank Duijm, Arjan Brouwer, Janneke Timmers, Harm Jan Kruisman and Linsey Groot for their important insights. Your commentaries have improved this paper greatly.