Root cause analysis can improve audits, regulators say