1

FVO meeting Dublin

March 9/10 2011

Beyond compliance auditing!

drs. Rob. S. de Heus EMIA RO; Head of the auditdepartment (CAE)Food and Consumer Product Safety Authority (VWA)

2

The problem defined

If compliance to Reg 882 / 2004 is required but repeatedly offended, another approach to auditing is preferred. (wondering versus verifying)

3

Compliance / conformity is about…

‘to do or not to do’,

but that’s no longer the question when employees frequently do not comply

4

3 starting points for (internal) auditing

Do we have a problem? (Problem detection);

What is the cause of the problem (diagnostic);

How do we assess the proposed solution? (design testing).

5

Verificating system

Operating system outputinput

Steering signal

Measuring outcome

Double loop learning (diagnostic auditing)Assessing the assumptions / ideas and standards

Single loop (Compliance auditing)consistency between outcome and standards

steering system

6

Internal (management) control

To find solutions for these issues, we have to pay more attention to management control,

…but, what is management control?

7

Management ControlAnthony: “The process by which managers influence other members of the organisation to implement the organisation’s strategy.”

John Kotter:“The central issue is never strategy, structure, culture or systems.The core of the matter is always about changing the behaviour of people.”

8

Management control issues (Kenneth A. Merchant, 1998)

Lack of direction (Do they understand what we expect of them …)

Personal limitations (Are they capable of doing what is expected of them ...

Lack of motivation (Will they work consistently hard and try to do whatis expected of them ...)

9

Thesis

If all the employees know what

should be done and are capable of

acting so and are willing to do so,

then complying to any rule or

regulation is no longer an issue!

10

In other words: How does management take care of employees ….

Knowing what to do;

Make them capable for their duties;

Preparing willingness to do what is asked for.

11

Example 1)

All employees have to fill in their time sheets within the first week of the new month, but they don’t do this!

knowledge ability intentions

• Employees are not informed about this instruction

• The registration systems are user unfriendly;

• It’s difficult to find the list with the most actual time registration codes

• Employees feel no importance at registrating;

• There is no supervision/control of completeness, timeliness and correctness

Employees are automatically informed (by the computersystem) when they have to fill in their time sheet. A hyperlink in the programme gives direct acces to the time codes table.

Solutions

12

Example 2)

Deficiencies are not documented

knowledge ability intentions

• Employees do not understand the reasons and the importance of documenting

• There is no system for recording defects;

• There’s not enough time;

• Data communication is too slow

• Employees are not interested in documenting;

• There is no supervision on completeness, timeliness and accuracy;

• It’s more comfortable to cooperate with the company then it is to confront them

Solutions: Allocate documentation-time in the planning;Discuss importance with them; so they know something is done with the documents

13

Example 3)

An incorrect model health certificate is been used

knowledge ability intentions

• Empl. are not informed well enough about the correct model health certificate and the correct attestation.

• There’s not enough appreciaton for Permanent Education

• There are no instructions and example certificates available

• There is no supervision of using the correct model health certificate;

• Dealing with transporters importing goods is always a matter of handling with pressure; it’s easier to cooperate with them, than to confront them

Solutions: Programmed solution; the system always gives the most actual certificate

14

Implications; 1) focus on management issues!...

Audit should direct the attention to the management actions to prevent

Lack of direction

Personal limitations

Lack of motivation

15

Implications 2) …and take a look at…!Examples of control actions by managementLack of direction Personal limitations Lack of motivation

• Clearness in instructions

• Setting smart goals• Updating the rules and

regulations• Codes of conduct• Mandates

• Providing means and materials

• Accessibility of information (systems)

• Consistency in assignments

• Behaviorial constraints• Separation of duties• Direct supervision• Peer reviews

• Acceptable workload• Paying attention to –• Adequacy in

communication• Creating shared

goals /beliefs• Discussing ethics and

morality• Creating an

atmosphere of trust• Giving compliments• Empowerment

16

Implications 3) add value!

By …

Paying attention more to causes than to problems / non-compliance only, and

Directing attention also to (sustainable) solutions

…auditing will deliver more added value to management

17

Implications 4) Challenges!It’s very challenging for auditors to give an opinion on the causes

of non compliance, because..

There is no standard or checklist

Auditors will be confronted with different perceptions

Auditors will wonder if they are in the right position to assess…

Auditors will wonder if they can conclude on the basis of subjectivity and opinions when there is lack of objectivity and/or facts

18

Implications 5) It’s possible!

But; we can do it !! There is already much to conclude from:

Missing actions (e.g. no supervision, no communication)

Inconsistencies (e.g. conflicting instructions)

Redundancy / overkill (e.g. unnecessary checks and balances while management wants to trust on employees expertise)

People’s attitude / motivation ( e.g. the way they speak about their work)

19

Conclusions

It’s not very effective to repeatedly conclude that our organisation is behaving in a non compliant way.

We can deal with this problem by changing the focus of our internal audits to a more diagnostic approach.

By doing this, we can define the underlying causes of non compliance and suggest ways to solve these issues.

In this way we really increase added value to management!

20

?Do you have any questions or remarks?