When a doctor treats a fever, they look beyond the symptoms to identify the underlying cause of the infection. Engineers don’t just patch cracks—they check the structure. In high-stakes professions, sustainable improvement begins with a deep understanding of why something failed.

Audit is no exception. Whether the goal is financial integrity or public trust, surface-level fixes fall short. Root cause analysis (RCA) isn’t just a quality tool—it’s the difference between temporary correction and lasting improvement. And, in many ways, it mirrors how we approach progress in life itself: nothing truly improves unless we understand its underlying cause.

Root Cause Analysis in Audit: Beyond the Obvious

In auditing, RCA plays a pivotal role in building a resilient quality management system. The Canadian Public Accountability Board (CPAB), in its June 2025 publication “Performing an Effective Root Cause Analysis: Strengthening Audit Quality,” emphasizes that firms investing in timely and robust RCA are better positioned to improve audit quality through targeted remediation and continuous learning.

Under Canadian Standard on Quality Management 1 – Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements (CSQM 1), firms are required to investigate the root cause(s) of identified deficiencies to assess their severity and design appropriate responses. But compliance alone is not enough. A superficial RCA might conclude: “The checklist wasn’t followed.” A meaningful RCA asks—Why wasn’t it followed? Was the training insufficient? Was the deadline unrealistic? Did leadership reinforce quality over speed?

A Fresh Illustration: The Case of the Misapplied Materiality Threshold

Consider a small firm auditing a fast-growing e-commerce client. During the internal quality review, the engagement was flagged for applying a materiality threshold that was too low, thereby omitting procedures in key areas, such as inventory and customer returns.

The initial reaction was to conduct a refresher session on materiality benchmarks. But a structured root cause analysis exposed deeper issues:

• Why was the wrong threshold applied? The team defaulted to prior-year benchmarks for a traditional retailer.
• Why didn’t they adjust for growth and volatility? No critical reassessment was performed at the planning stage.
• Why did this go unchecked? The partner delegated planning decisions without a second-level review.
• Why was that allowed? The firm lacked a formal policy for second-partner review on engagements with heightened risk.

Root cause: A structural gap in the firm’s planning methodology and quality review process when dealing with dynamic or high-growth clients.

Remediation included:

• Updating audit planning guidance to include sector-specific materiality adjustments.
• Mandating a second-partner review for all clients with >25% YoY growth or significant business model change.
• Creating a standardized checklist to review the applicability of prior-year assumptions.

This example shows that what first appears as a technical oversight often points to broader deficiencies in governance, methodology, or culture, only uncovered through careful RCA.

Why This Matters for Small Firms

For small firms, every engagement carries reputational weight. CPAB notes that while RCA is universally valuable, it is particularly critical for smaller firms with limited buffers against recurring deficiencies.

The June 2025 publication offers guidance tailored to smaller practices, emphasizing:

• The need for independence in conducting RCA
• Timely resolution of audit quality events (ideally within 30–90 days)
• The importance of learning from both failures and successes to inform the system of quality management

Firms that embed RCA into their DNA move from reactive correction to proactive quality enhancement.

Practical To-Do List: Embedding RCA in Audit Practice

To help firms implement RCA effectively, CPAB outlines several best practices:

1. Engage the right people

• • Use independent reviewers not involved in the engagement
  • Train them in structured interviewing and causal analysis

2. Capture meaningful insights

• • Conduct interviews across all levels of the audit team
  • Include reviewers and quality monitors to explore missed signals

3. Apply structured techniques

• • Use the “Five Whys” or Fishbone Diagram to explore cascading causes
  • Perform a stand-back analysis to re-evaluate conclusions

4. Tie findings to the system of quality management

• • Examine links to governance, resourcing, supervision, and acceptance procedures
  • Document systemic themes across multiple engagements

5. Design targeted action plans

• • Set measurable KPIs tied to quality outcomes
  • Implement monitoring mechanisms to assess effectiveness

6. Promote firm-wide learning

• • Share lessons through templates, training, and “lunch & learns”
  • Reinforce positive behaviors, not just eliminate negative ones

KNAV Opinion

Root cause analysis is more than a compliance requirement. It’s a discipline that invites accountability and systems thinking. It reminds us that behind every audit lapse lies a chain of contributing factors—and that progress starts with understanding those links.

As CPAB rightly states, “Firms that invest in robust root cause analysis processes are better positioned to identify underlying issues, audit quality risks and to reinforce positive behaviours.”

Because, in audit as in life, nothing meaningful changes until we get to the root of it.