STORY David Walker

ILLUSTRATION James Hancock

1. Keep asking why

The discipline of asking why is at the core of root cause analysis. BDO Australia’s national leader for audit quality, Jane Bowen CA, says the key lesson of her time using the technique is “not to stop too soon”.

Practitioners must “get beneath the surface level reasons,” she says. “If you stop the questioning too soon you don’t actually get to the underlying root cause. You know, what is the reason that they didn’t have time to do that on the engagement? What is the underlying reason that they didn’t realise that they had to document something in response to a particular risk?”

The answers to these questions may be about the firm’s management processes or the running of an audit practice, rather than about an individual engagement.

Grant Thornton assurance partner Merilyn Gwan CA shares a story to illustrate the technique. Your car gets a flat tyre. Why? You ran over a nail on the garage floor. But that’s not the root cause. You ask ‘why’ again, and find the box of nails on the shelf fell apart. Why? The box got wet. Why? You’ve had a hole in your roof. The lesson: don’t just stop at the first ‘why’; seek the deepest possible cause.

EY quality enablement leader Chris Lawton CA says EY has built its interview process to avoid stopping the questioning too early. The firm sets up separate discussions with all the relevant team members, but it aims to start with the more junior members.

That way, he says, members of the quality team “don’t get a perspective from the partner straight out of the chute that may tend to blindside you a little bit to any other perspective”.

2. Expect early defensiveness

Lawton recalls that early on in EY’s rollout of root cause analysis, staff saw the technique as just another way to tell them they didn’t do something properly.

“Their first reaction tends to be a bit defensive,” adds Valerie Clifford FCA, the assurance risk and quality partner for PwC Australia. “People can be quite... ‘abrupt’ is probably the word – abrupt and defensive.”

She works to help them understand that the process is not a personal attack. At the same time, she presses for the explanation of why events during the audit happened as they did. “When you start doing that,” she says, “people tend to open up more.”

Gwan adds that it’s important to take care with your vocabulary. “You want to be really careful when you describe what you are doing to a team.”

For instance, if a review finds that “leadership wasn’t involved at the right time”, many partners may take offence. But Gwan explains that such wording might simply mean they have had the conversation and not documented it properly in the file – which means an outside reviewer has no evidence that the conversation ever happened. It’s critical for auditors to document such sidebar conversations, she says.

3. Understand what’s going right, as well as wrong

Firms can also learn a lot from applying root cause analysis to audits that went well.

“Don’t just look at the bad, look at the good,” is Gwan’s advice.

She recalls one audit for an ASX-listed entity working in a new industry with a focus on new technology. The business was complex enough that the audit team enlisted IT specialists from around the world. The analysis showed that the partner and the manager had also responded to the complex brief by involving themselves more heavily in the audit’s early stages – the risk assessment, the understanding of the client’s systems, the fundamental understanding of their debits and credits, and the fundamentals of the business generally.

“And it led to a better-quality audit,” says Gwan.

But the more successful audit was gained at the expense of partner time – over 30% of time on the audit, rather than the typical 5-15%.

How to balance the benefits gained with the cost of the additional partner time remains an unsolved problem. But Grant Thornton is now experimenting to find ways to exploit this new learning.

4. Analyse the pile-ups

Frequently there is not one root cause of problems but several. Clifford, for instance, has noticed engagements where an incident would not normally have led to a finding, but the normal checking process failed – “senior people up the tree didn’t pick it up”.

In these cases, one root cause may be a high turnover of managers in an audit area. That may lead to action to mitigate the turnover. The common thread in such cases is “other things that happened, often operational in nature, in conjunction with the first problem,” explains Clifford.

The teams at Deloitte and PwC, among others, are making more use of data analysis to identify such confluences of events. Put enough data points together, says Clifford, and you see patterns: specialists providing services outside their area of expertise, say, or an audit with a high number of new recruits.

Audits go wrong in much the same way that other processes go wrong, she notes. People inherently want to do the right thing, but sometimes multiple factors come together to create a different outcome – “a sort of perfect storm”.

5. Work on solutions

Gwan most enjoys the last stage of root cause analysis – implementing solutions.

“You can put measures in place, change a policy because it’s not appropriate, look at the training.”

But she also acknowledges the difficulties of this phase. She has been dealing with the results of a root cause analysis that indicated partners should spend more time upfront on certain engagements. But partners’ time is critical; every additional hour they invest takes them away from other work with the client base. Grant Thornton faces a major exercise to make the change a reality.

It’s probably the biggest single impact the firm has seen so far from root cause analysis. But Gwan warns: “It’s not going to be a quick fix.”

Bowen agrees that implementing solutions is the toughest stage. People want to make improvements, she says. But they must also resist the temptation to just add to the firm’s existing processes and build up the workload.

“The biggest time component of root cause analysis is how you’re going to respond to the causes that have been identified,” Bowen says. “That’s where the real time is taken.”

“The biggest time component of root cause analysis is how you’re going to respond to the causes that have been identified.”

Read more: