QM standards: How to perform a root cause analysis

The interrelated final standards on quality management issued in June 2022 by the AICPA’s Auditing Standards Board and Accounting and Review Services Committee are intended to clarify and improve existing quality processes for audit and accounting engagements. The new quality management standards require firms to adopt a risk-based approach to establish a system of quality management. (See sidebar “Overview of the New Standards.”)

Firms still have to institute policies, but the old process was more prescriptive and not as tailored to the nature and circumstances of the firm.

Statement on Quality Management Standards (SQMS) No. 1, A Firm’s System of Quality Management, requires firms to design and implement a system of quality management tailored to their practices and engagements by Dec. 15, 2025. The system must be evaluated by firm leadership to conclude it is meeting its objectives by Dec. 15, 2026, and annually thereafter.

SQMS No. 1 introduces a new approach for firms with a focus on risks that may impact their engagement quality. A system of quality management includes eight integrated components.

The first component is a risk assessment process consisting of three steps:

• Establishing quality objectives
• Identifying and assessing risks that could prevent achieving those objectives (quality risks)
• Designing and implementing responses to address quality risks

Firms are required to identify any need for additions or modifications to quality objectives, quality risks, and responses.

A separate component addresses the required enhanced process for monitoring and remediating the system of quality management. SQMS No. 1 shifts the focus of monitoring from the engagement level to the system-of-quality-management level. Firms should tailor their monitoring processes to firm-specific factors. The standard does not prescribe the monitoring activities, but it indicates that the process should provide relevant, reliable, and timely information about the design, implementation, and operation of the system of quality management and that firms should take appropriate actions to respond to and remediate identified deficiencies on a timely basis.

Also, firms are required to inspect completed engagements and engagement partners on a cycle basis, with the firms determining which engagements and partners they select and how frequently.

“Firms are pushing hard to design and implement the core [system of quality management] components,” said Joe Lynch, CPA/CITP, Denver-based managing director and shareholder at Johnson Global Accountancy.

Firms will have policies and procedures in place, but based on his experience with firms implementing new processes and controls, Lynch projected there’s a high likelihood some new procedures will fail when tested in the first year. The firms will then have to make changes to their processes and monitoring strategies.

INVESTIGATING THE ROOT CAUSES OF DEFICIENCIES

As part of the monitoring and remediation component, SQMS No. 1 requires firms to evaluate findings, identify deficiencies in the system of quality management, and evaluate how severe and pervasive the deficiencies are. That includes investigating the root causes of identified deficiencies.

The objective of the root cause investigation is for firms to understand the circumstances that cause the deficiencies so they can evaluate how severe and pervasive the deficiencies are and appropriately remediate them.

Firms may tailor and scale the nature, timing, and extent of their procedures to understand the root causes of deficiencies in relation to their circumstances and the nature and potential severity of the identified deficiencies. They are also required to design and implement remedial actions that are responsive to the results of the root cause analysis. Professional judgment is required, using available evidence.

The quality management standards define “findings” as “information about the design, implementation, and operation of the [system of quality management] accumulated from performing monitoring activities, external inspections, and other relevant sources, which indicates one or more deficiencies may exist.”

“When firms look at findings from monitoring activities, they need to consider how the finding impacts the response that mitigates the risk,” Lynch said. “The relationship could potentially be small and not relevant. Not all findings will be deficiencies.”

According to the quality management standards, deficiencies exist when a quality objective is not established; a quality risk is not identified or properly assessed; responses do not reduce to an acceptably low level the likelihood of a related quality risk occurring because the responses are not properly designed, implemented, or operating effectively; or another aspect of the system of quality management is absent or not properly designed, implemented, or operating effectively.

“Deficiencies include both severity and impact, and severity could relate to likelihood of occurrence,” Lynch said. “Firms need to consider what did happen and what could happen, including quantitative (number of engagements, financial results) and qualitative (image and integrity) impacts.

“Under the standard, if you identify a finding that does not rise to the level of a deficiency, you have the option to develop a remediation plan,” he added. “You can choose not to do any root cause analysis on the finding, but you should look for common causal factors with other findings that may roll up to a deficiency.”

Firms need remediation plans for all deficiencies that consider why the deficiency happened and may go beyond the area where it occurred. “A specific engagement matter may be caused by firm-level issues that the deficiency brought up, like a lack of firm guidance,” Lynch said. “Remediation plans should be actionable.”

SQMS No. 1 includes an example of an identified deficiency: A firm identified that audit engagement teams did not obtain sufficient appropriate audit evidence for accounting estimates when management’s assumptions were highly subjective. The root cause could be lack of professional skepticism, or the deficiency could result from the firm having insufficient supervision and review of engagements or an environment that does not encourage engagement team members to question individuals with greater authority.

WAYS TO PERFORM A ROOT CAUSE ANALYSIS

“Root cause methodology is not new. It has been used in many industries for years. It is a way to understand and document how things work, and it allows collective knowledge to come together,” Lynch said. “Firms need a root cause analysis process that is iterative and not linear; they need to understand the problem, brainstorm why it happened, bring people together, and avoid functional silos.”

SQMS No. 1 indicates that the root cause analysis should be performed by individuals assigned operational responsibility for the system of quality management. “This will vary by firm, but [the person] is usually a partner with deep experience with the firm’s projects and audits,” Lynch said. “For larger firms, this may be the partner in charge of quality, with a small- to medium-size team and a director or senior manager to execute this responsibility. The person should be a doer and influencer, with operational leadership experience.”

The root cause analysis will also vary based on the size and complexity of the firm, he added. “In a small firm with a single office, a few partners, and a small staff, where everyone talks to each other daily, root causes will be more apparent, although the steps are the same as for larger firms. Mid-tier firms that specialize in certain audits or industries may have a part-time quality partner and may need to hire, reallocate resources, or go outside for help with root cause analysis. Larger firms must address multiple locations and different departments but have greater resources.”

The standard provides that firms may use network services or a service provider to assist them with performing monitoring activities if firm personnel do not have the competence, sufficient time, and objectivity. Self-review threats may exist if individuals performing monitoring activities were involved in the engagements being monitored, and it may be more effective to have someone else inspect for compliance and propose remediation.

SQMS No. 1 calls for firms to look at their operating components and organizational structure, which goes beyond the performance of required quality control procedures in QC section 10, A Firm’s System of Quality Control, which SQMS No. 1 supersedes. “Firms are continuing with their internal inspections at the engagement level and then expanding them to include areas that could be challenging for the firm overall, like resources, skill sets, and how they apply methodology,” Lynch said.

What does a root cause analysis look like?

Lynch shared the following common example: The engagement inspection process found that the engagement team failed to perform sufficient valuation procedures for fixed assets. To perform root cause analysis, the engagement team was brought together to find out what happened and why. The senior manager had not been involved in auditing fixed assets before, but the partner on the engagement had this experience. Questions asked were: Why was that senior manager assigned? Why didn’t the partner supervise the senior manager? At a broader level, were there other causes, like lack of specific professional training, staff competence, workload, and staff assignment issues? Was the partner workload too great and the partner did not have time to supervise? If so, was this because there were economic pressures on the firm to take on more clients? Is the client acceptance process sufficient?

“Root cause analysis requires asking tough questions, and you need to go where the answers to questions take you and keep asking why,” Lynch said. “Firms need to keep ‘pulling the thread’ and then other threads may be uncovered. There may be a need to fix the audit procedures at the engagement level, but there may also be bigger operational and human resource issues.”

To identify root causes, he said, firms may need to gather firm data about engagements and staffing to give them a better perspective and enable them to ask better questions.

The system of quality management must be documented, including the results of the monitoring and remediation process and the root cause analysis. “The process must be objective so people don’t feel they are being called out,” Lynch said. “Interviews can be uncomfortable, and some firms may choose someone from another department or an outside person to do them.”

The information obtained is put into the remediation plan so firms can check in the future whether process changes were made and what the results were.

SQMS No. 1 indicates that firms can also investigate the root causes of positive outcomes and use them to enhance their system of quality management. “The root cause analysis of why something worked can help firms repeat it and is an important opportunity for improvement,” Lynch said. “In the example above, for the same client, if the senior manager had done a good job of auditing revenue based on applying experience gained from other clients, sharing that information within the firm and applying practices more broadly beyond the engagement could lead to putting better procedures or more training in place.”

For Lynch, “the essence of the standard is all about moving from a reactive, control-by-control approach to a proactive approach. It is an enhancement opportunity to bring the power and knowledge of the firm together to improve the system of quality management and audit quality.”

Overview of the new standards

The new standards will apply to all firms that conduct any audits, attest examinations, financial statement or attest reviews, compilations, or agreed-upon-procedures engagements. Here’s a rundown of the new standards with a brief description of each:

■ Statement on Quality Management Standards (SQMS) No. 1, A Firm’s System of Quality Management, introduces a new risk-based assessment process and requires firms to design, implement, and operate a system of quality management customized to their practice and engagements. This includes establishing quality objectives, assessing the specific risks to quality, and designing and implementing responses to address those risks. In addition, firm leadership is required to evaluate annually whether the firm’s system of quality management is meeting its objectives. The approach calls for continuous improvement and ongoing remediation over time. SQMS No. 1 supersedes Statement on Quality Control Standards No. 8, A Firm’s System of Quality Control.

■ SQMS No. 2, Engagement Quality Reviews, applies when a firm decides that an engagement quality (EQ) review is an applicable response to address its engagement performance quality management objective. This new standard addresses the appointment and eligibility of the EQ reviewer (whether inside or outside of the firm) and performance of the EQ reviews.

■ SQMS No. 3, Amendments to QM Sections 10, A Firm’s System of Quality Management, and 20, Engagement Quality Reviews:

• Amends QM sections 10 and 20 to conform certain terms to language used in SAS No. 149, Special Considerations — Audits of Group Financial Statements (Including the Work of Component Auditors and Audits of Referred-to Auditors).
• Provides guidance on differentiating between a resource and an information source.
• SQMS No. 3 is effective concurrently with the effective dates provided in QM sections 10 and 20.

■ Statement on Auditing Standards (SAS) No. 146, Quality Management for an Engagement Conducted in Accordance With Generally Accepted Auditing Standards, focuses on quality management for audits at the engagement level, including the engagement partner’s responsibility for managing engagements to achieve quality, and the importance of quality to all members of the engagement team.

■ Statement on Standards for Accounting and Review Services (SSARS) No. 26, Quality Management for an Engagement Conducted in Accordance With Statements on Standards for Accounting and Review Services, amends the SSARSs to conform with SQMS Nos. 1 and 2.

Other significant changes include two new components of systems of quality management (the risk assessment process and the information and communication component), more robust requirements for leadership and governance, enhanced monitoring and remediation processes, and new requirements for networks and service providers.

About the author

Maria L. Murphy, CPA, is a senior content management consultant, accounting and auditing products for Wolters Kluwer Tax & Accounting North America, and a freelance writer based in North Carolina.

LEARNING RESOURCES

Understanding and Implementing the New Quality Management Standards

Enhance your understanding of risk assessment and quality management to implement effective quality management systems for your firm’s A&A practice.

CPE SELF-STUDY

New Quality Management Standards: Resources — Expectations for Firms and Engagement Partners

In a thriving quality management system for your firm’s A&A practice, your resources need to be allocated properly. We’ve got actionable insights for you.

Dec. 19, 1–2 p.m. ET

WEBCAST

New Quality Management Standards: What’s New for Firms’ Monitoring and Remediation Processes

Statement on Quality Management Standards No. 1 requires firms to perform enhanced monitoring and remediation activities. Start now by learning what you need to know to comply with the new standards.

Dec. 19, 2–3 p.m. ET

WEBCAST

New Quality Management Standards: Bringing It All Together — Exploring All Components of a Quality Management System

The newly issued Statement on Quality Management Standards No. 1 requires firms to design, implement, and operate a new quality control system by Dec. 15, 2025.

Dec. 20, 1–2 p.m. ET

WEBCAST

New Quality Management Standards: A Practical Approach to Risk Assessment and Response

Learn about SQMS No. 1 and understand the new risk-based approach to quality management, with emphasis on creating processes tailored to your firm’s needs for its A&A practice.

Dec. 21, 1–3 p.m. ET

WEBCAST

For more information or to make a purchase, go to aicpa-cima.com/cpe-learning or call 888-777-7077.

AICPA & CIMA RESOURCES

Articles

“QM Is Approaching Faster Than You Think — Get Ready,” JofA, Nov. 1, 2023

“Quality Management Standards: How to Identify Risks and Design Responses,” JofA, July 18, 2023

“New Standard Provides Risk-Based Approach to Group Audits,” JofA, March 7, 2023

Website

A number of quality management resources are available at aicpa-cima.com/auditqm, including a crosswalk that compares the existing quality control standards with the new quality management standards.

In addition, the AICPA Quality Management Task Force developed a free practice aid and accompanying tool with example risks and responses that align with the quality management objectives in the standards. It also includes tips, tricks, and warnings to help firms apply the new standards, similar to the AICPA’s current quality control practice aid. Versions for sole practitioners and small- and medium-size firms are offered.