operational auditing, tools for improving business outcomes

8/3/2019 Operational Auditing, Tools for Improving Business Outcomes

http://slidepdf.com/reader/full/operational-auditing-tools-for-improving-business-outcomes 1/53

Operational AuditingTools for Improving Business Outcomes

Mike Jacka, CIA, [email protected]

Paulette Keller, CIA, CPA [email protected]



Outline

Definitions & Standards

Relationship with Management Operational Auditing Tools

– Risk/Control Matrix

– Business Process Mapping

– RACI Matrix – Customer Mapping

– Spaghetti Maps



Internal Audit - definition

IIA definition of Internal Auditing – “Internal auditing is

an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization

accomplish its objectives by bringing a systematic,disciplined approach to evaluate and improve the

effectiveness of risk management, control, and governance processes.”



Evaluating Controls

Standard 2130 – ControlThe internal audit activity should assist the organization in maintaining

effective controls by evaluating their effectiveness and efficiency and

by promoting continuous improvement.

2130.A1 - The internal audit activity must evaluate the adequacy and effectiveness of controls in responding to risks within the organization’s governance, operations, and information systems regarding the:

– Reliability and integrity of financial and operational information; – Effectiveness and efficiency of operations; – Safeguarding of assets; and

– Compliance with laws, regulation, and contracts.

2130.A2 - Internal auditors should ascertain the extent to which operating and program goals and objectives have been established and conform to those of the organization.

2130.A3 - Internal auditors should review operations and programs to ascertain the extent to which results are consistent with established goals and objectives to determine whether operations and programs are being implemented or performed as intended.



Operational Auditing - definition

A systematic check or assessment of the efficiency or effectiveness of a company’s business operations

The objective of operational auditing is to appraise the effectiveness and efficiency of a division, activity, or operation of the entity in meeting organizational objectives and goals

EvaluatesOperations

Focus on

Organizationalgoals

Assurance on

efficiencyand effectiveness



Maintaining Independence

Standard 1100 – Independence and Objectivity

The internal audit activity should be independent, and internal auditors should be objective in performing

their work.

Standard 1120 – Individual Objectivity

Internal Auditors should have an impartial, unbiased attitude and avoid conflicts of interest.



Relationship with Management

Why does management need operational audits?

What type of relationship will Audit need withManagement to facilitate a review of operations?

What kind of competencies do auditors need toperform operational reviews?



Operational Auditing Process

Identify management’s objectives

Determine where an operational review would add the most value

Gain an understanding of the process Prepare a risk/control matrix for the areas under review

Assess efficiency and effectiveness of the control design

Assess the efficiency and effectiveness of critical controls

Report findings and/or recommendations



Operational Auditing Tools

Risk Control Matrix

Business Process Mapping RACI Matrix

Customer Mapping

Spaghetti Maps



Risk Control Matrix

Start with management objectives – (What do they want to achieve – the end result)

Identify risks to accomplishing those objectives

– (What could go wrong?) Identify controls for each risk

– (What could prevent the risk or minimize it?)

Objective Risk Control



Identifying objectives

Objectives state what is trying to be

accomplished, not how Strategic objectives

– What must be done to assure the organization’s strategy is

achieved.

Process objectives

– What the process is trying to achieve (why it exists) – Broad objectives and sub-objectives may exist



Exercise 1 –

Objective Evaluation

The organization has a strategic objective of assuring the rightpeople are in right place at the right time.

HR is a support function that assists management in execution ofthe organization’s people management strategies and it alsohelps assist the organization in compliance with legal andregulatory requirements. Key processes HR is involved withinclude: terminations, recruiting, promotions, performance

review, and succession planning.

Determine if the following objectives are good objectives for HR. Ifnot, explain what is wrong with the objective.



Exercise 2 – Car Stereo Objective

Setting

You work for the Good, Cheap Car Stereo Store. The store is a localchain with 4 stores in the metropolitan area. There is a showroom,where the sales staff greets potential customers and shows them

products. If a customer purchases a stereo, they can install itthemselves, or they may have it installed at the store. An inventory ofstereos and installation materials is maintained at the local store.

Write objectives for the following processes for Good, Cheap Car StereoStore. Make any assumptions you need to.

Sales Stocking Installation Customer Satisfaction



Identifying Risk

Risks are related to objectives

Risks are things that could happen that might impactthe achievement of business objectives.

Risks are not the opposite of the objective. Risks areevents. You can also think of what needs to go rightto assure the objective is achieved – if it does not goright, then you have your risk.



Exercise 3 –

Identifying Risk

Look at the objectives developed in the Car

Stereo exercise. Identify two key risks foreach objective. Use any personal knowledgeyou have about stereos, shopping, or sales.



Risk Control Matrix

Possible forms for matrix – Handout

Practice using a Risk Control Matrix – Exercise 4



Business Process Mapping

A holistic approach



Business Process Mapping

Why analyze processes?

The accumulation of activities that take place in each business process is what ultimately determines whether or not a business meets

its objectives.



Benefits of Business Process Mapping

Holistic view

Employee’s buy-in Sense of pride

Customer driven



Process defined

Input

Action Output

Feedback



The process of mapping

Process identification

Data gathering Interview and map generation

Analyzing the data

Presentation



Process identification

What you see is primarily what you look at……

Determine where the process begins andends

Major events that trigger the start and end ofthe process

Naming the major processes

Process timelines



Data gathering

Where you go to learn it

Process owners

Unit owners

Unit owners or employees

What you don’t know

Process descriptionoverview, unit owners,objectives, risks, measuresof success.

Process definition – detailed, Triggers,

inputs/outputs

Tasks



Data Gathering Tool

Process Profile Worksheet

Process Name and Number Process Owner

Description

Triggers

Event beginning:

Event ending process:

Additional Events:

Input Items and Sources

Output Items and Customers

Process Units Process Unit Owners

Business Objective(s) Business Risks

Key Controls Measures of Success



Interviewing and Mapping

Ground rules

–

Buy-in, time, privacy, tone, listen – Mapper and recorder roles

Select the right people



The Map

Supplies – Sticky notes, felt tip pens, poster sized sticky paper.

People in columns – chronologically

Time – top to bottom

Action – verb/noun on post-it

Basic symbols

Cycle times



Hands On

Exercise 5 – Process Mapping Basics

Exercise 6 – Process Mapping BasicSymbols

Exercise 7 – Process Mapping Verb/NounFormat

Exercise 8 – Process Mapping CompleteMap



Into the editing room

Inputs, outputs, and waste

Surprises Invisible consequences

Process ownership

Objectives, risks, controls Measures of success



Analysis tips

Remove approvals

Looping errors

Isolate delays, rework, handoffs

Follow the forms

Incomplete maps – dangling actions,

unanswered questions Question hold files

Look at cycle times



Finalize the project

Look for areas to add value

–

Business value – improve efficiency,effectiveness, or provide economies

– Customer value

Present conclusions and recommendations



Pitfalls and traps

We’re drowning in information and starving for knowledge

Mapping for mapping sake Round and round – up and down Failure to finalize Letting the clients define the process

Leading the witness Verifying the facts Do not forget the customer No tool is an island



RACI Matrix

Responsibility Charting



RACI Matrix –

Responsibility Charting

A technique for identifying functional areas, keyactivities, and decision point where ambiguities exist.

Management actively participates in the process ofsystematically describing activities, decisions thathave to be accomplished, and clarification of the

responsibility that each plays in relation to thoseactivities and decisions.



RACI - Benefits

Assists work teams in charting roles and responsibilities

Clarifies individual/departmental roles and responsibilities

Identifies accountabilities

Eliminates misunderstandings, encourages teamwork

Reduces duplication of efforts

Establishes “consults” and “informs” resulting in better communicationmisunderstanding



RACI Matrix - Guidelines

Look for improved efficiency and economies – Eliminate “checkers checking checkers”

– 100% accuracy not always required Place accountability (A) and responsibility (R) at the

level closest to the action or knowledge There can be only one accountability per activity Authority must accompany accountability

Minimize the number of consultants (C) and informs(I)

All roles and responsibilities must be documentedand communicated.



RACI Matrix - Explainer

“A” – Accountable – “The buck stops here” – positionwith yes/no authority. Only one A per function.

“R” – Responsible – “The doer” – Position working onthe activity. Responsible for action/implementation.Degree of responsibility determined by individualwith the “A”.

“C” – Consult – “In the loop” – Position involved prior to

decisions or action - two-way communication.“I” – Inform – “Keep in the picture” – Position that needsto know of the decision or action – informed after – incorporates one-way communication.



RACI –

Determining Responsibilities

Exercise 9



RACI Matrix Development Process

Develop decision /activity list - (tasks – action verbs)

Develop function lists (position assigned to an activity or sub-activity)

Agree on function definitions

Output in a responsibility chart

Agree chart with key individuals

Circulate



RACI Chart Example



RACI –

Vertical Analysis

Lots of R’s – does the individual havetoo much work

No empty spaces – does the individualneed to be involved in this manyactivities. Are they a gatekeeper?

No R’s or A’s – should the role beeliminated?

Too many A’s – is there proper

segregation of duties? Is this abottleneck?

Qualification - Does the type or degreeof participation fit the qualifications ofthe role?



RACI –

Horizontal AnalysisNo R’s – is the job getting done?

Too many R’s – is this a sigh of “over the

wall” activities? Just get it off my desk?

No A’s – Why note? Who is accountable

To many A’s – Is there confusion? Who isdoing what?

Too few A’s and R’s – Is the processslowing down while activity is performed onan “ad hoc” basis. Are procedures

outdated and need to be streamlined.

Lots of C’s – are they necessary

Lots of I’s – should this be standard or onlyon an exception basis.

All boxes full – Too many people involved.



RACI Matrix - Practice

Exercise 10 – Expense Reporting RACI Matrix



Customer Mapping

“There is only one valid definitionof a business purpose: to createa customer.”

Peter Drucker

– the Practice of Management (1954)



Customer MappingIdentifying Jobs the Customer Wants to Get Done

A business is “defined by the want the

customer satisfies when she buys a productor service”

Peter Drucker



Identifying customer jobs

When the business focuses on the jobs the customer is trying to get done,they can develop innovative solutions to satisfy those jobs.

Asking customers what they want is not necessarily going to provideyou with a good definition of the job they want to do.

When Apple developed the Ipod, they defined the job the customer’s

wanted done as “managing their music”, not a better music player.

The focus is on the job – not the solution.



Customer Mapping

Process Mapping focuses on the Company’s Processes – but what ifthose processes are not producing outcomes the customer desires?

Customer Mapping focuses on the job the customer is doing, the tasks thecustomer must do to accomplish the job, and the customer’s measures

of success.



Customer Mapping –

the process

Define the job

Define the tasks the customer must perform (verb/noun)

Define customer inputs and outputs Define the customers measures of success (minimize/maximize)

Rank the measures of success

Compare results to the measures

Look in depth (Process Maps) for areas that do not measure up

Exercise 11 – Group Exercise - Complete a Customer Profile Worksheet



Customer Profile Worksheet

Customer Profile Worksheet

Job Description:

Trigger:

Functional Job:

Personal Job:

Social Job:

Task Actions Input Output Measure of Success Ranking

1 = low

5 = high

Results

1.

2.



Spaghetti Map

“As Is” and “To Be”



Spaghetti Maps

While traditional flow charts or process maps may beused to identify control points, spaghetti diagrams

can be used to quickly identify inefficiencies.1. Interview employees to determine the process flow.

2. Document the “As Is” process flow using a narrative and

nodes to symbolize the movement of key items throughthe process.

3. Document the “To Be” process by eliminating some of the

steps in the process which might create efficiencies.



Spaghetti Map - Example

Exercise 12 – Create a “To Be” map



Spaghetti Map –

To Be

Exercise 12

Create to “To-Be” Spaghetti Map of theEmployee Expense Reimbursement processusing everything you have learned about thisprocess or information you know about other

processes that are more efficient.

operational auditing, tools for improving business outcomes

Documents