Operational Auditing Tools for Improving Business Outcomes

1
Operational Auditing Tools for Improving
Business Outcomes

• Mike Jacka, CIA, CPA
• mike_jacka_at_farmersinsurance.com
• Paulette Keller, CIA, CPA
• paulette.keller_at_farmersinsurance.com

2
Outline

• Definitions Standards
• Relationship with Management
• Operational Auditing Tools
• Risk/Control Matrix
• Business Process Mapping
• RACI Matrix
• Customer Mapping
• Spaghetti Maps

3
Internal Audit - definition

• IIA definition of Internal Auditing Internal
  auditing is an independent, objective assurance
  and consulting activity designed to add value and
  improve an organizations operations. It helps
  an organization accomplish its objectives by
  bringing a systematic, disciplined approach to
  evaluate and improve the effectiveness of risk
  management, control, and governance processes.
  

4
Evaluating Controls

• Standard 2130 Control
• The internal audit activity should assist the
  organization in maintaining effective controls by
  evaluating their effectiveness and efficiency and
  by promoting continuous improvement.
• 2130.A1 - The internal audit activity must
  evaluate the adequacy and effectiveness of
  controls in responding to risks within the
  organizations governance, operations, and
  information systems regarding the
• Reliability and integrity of financial and
  operational information
• Effectiveness and efficiency of operations
• Safeguarding of assets and
• Compliance with laws, regulation, and contracts.
• 2130.A2 - Internal auditors should ascertain the
  extent to which operating and program goals and
  objectives have been established and conform to
  those of the organization.
• 2130.A3 - Internal auditors should review
  operations and programs to ascertain the extent
  to which results are consistent with established
  goals and objectives to determine whether
  operations and programs are being implemented or
  performed as intended.

5
Operational Auditing - definition

• A systematic check or assessment of the
  efficiency or effectiveness of a companys
  business operations
• The objective of operational auditing is to
  appraise the effectiveness and efficiency of a
  division, activity, or operation of the entity in
  meeting organizational objectives and goals

Evaluates Operations
Focus on Organizational goals
Assurance on efficiency and effectiveness
6
Maintaining Independence

• Standard 1100 Independence and Objectivity
• The internal audit activity should be
  independent, and internal auditors should be
  objective in performing their work.
• Standard 1120 Individual Objectivity
• Internal Auditors should have an impartial,
  unbiased attitude and avoid conflicts of
  interest.

7
Relationship with Management

• Why does management need operational audits?
• What type of relationship will Audit need with
  Management to facilitate a review of operations?
• What kind of competencies do auditors need to
  perform operational reviews?

8
Operational Auditing Process

• Identify managements objectives
• Determine where an operational review would add
  the most value
• Gain an understanding of the process
• Prepare a risk/control matrix for the areas under
  review
• Assess efficiency and effectiveness of the
  control design
• Assess the efficiency and effectiveness of
  critical controls
• Report findings and/or recommendations

9
Operational Auditing Tools

• Risk Control Matrix
• Business Process Mapping
• RACI Matrix
• Customer Mapping
• Spaghetti Maps

10
Risk Control Matrix
Objective
Risk
Control

• Start with management objectives
• (What do they want to achieve the end result)
• Identify risks to accomplishing those objectives
• (What could go wrong?)
• Identify controls for each risk
• (What could prevent the risk or minimize it?)

11
Identifying objectives

• Objectives state what is trying to be
  accomplished, not how
• Strategic objectives
• What must be done to assure the organizations
  strategy is achieved.
• Process objectives
• What the process is trying to achieve (why it
  exists)
• Broad objectives and sub-objectives may exist

12
Exercise 1 Objective Evaluation

• The organization has a strategic objective of
  assuring the right people are in right place at
  the right time.
• HR is a support function that assists management
  in execution of the organizations people
  management strategies and it also helps assist
  the organization in compliance with legal and
  regulatory requirements. Key processes HR is
  involved with include terminations, recruiting,
  promotions, performance review, and succession
  planning.
• Determine if the following objectives are good
  objectives for HR. If not, explain what is wrong
  with the objective.

13
Exercise 2 Car Stereo Objective Setting

• You work for the Good, Cheap Car Stereo Store.
  The store is a local chain with 4 stores in the
  metropolitan area. There is a showroom, where
  the sales staff greets potential customers and
  shows them products. If a customer purchases a
  stereo, they can install it themselves, or they
  may have it installed at the store. An inventory
  of stereos and installation materials is
  maintained at the local store.
• Write objectives for the following processes for
  Good, Cheap Car Stereo Store. Make any
  assumptions you need to.
• Sales
• Stocking
• Installation
• Customer Satisfaction

14
Identifying Risk

• Risks are related to objectives
• Risks are things that could happen that might
  impact the achievement of business objectives.
• Risks are not the opposite of the objective.
  Risks are events. You can also think of what
  needs to go right to assure the objective is
  achieved if it does not go right, then you have
  your risk.

15
Exercise 3 Identifying Risk

• Look at the objectives developed in the Car
  Stereo exercise. Identify two key risks for each
  objective. Use any personal knowledge you have
  about stereos, shopping, or sales.

16
Risk Control Matrix

• Possible forms for matrix Handout
• Practice using a Risk Control Matrix Exercise 4

17
Business Process Mapping

• A holistic approach

18
Business Process Mapping

• Why analyze processes?
• The accumulation of activities that take place in
  each business process is what ultimately
  determines whether or not a business meets its
  objectives.

19
Benefits of Business Process Mapping

• Holistic view
• Employees buy-in
• Sense of pride
• Customer driven

20
Process defined

• Input
• Action
• Output
• Feedback

21
The process of mapping

• Process identification
• Data gathering
• Interview and map generation
• Analyzing the data
• Presentation

22
Process identification

• What you see is primarily what you look at
• Determine where the process begins and ends
• Major events that trigger the start and end of
  the process
• Naming the major processes
• Process timelines

23
Data gathering

• Where you go to learn it
• Process owners
• Unit owners
• Unit owners or employees

• What you dont know
• Process description overview, unit owners,
  objectives, risks, measures of success.
• Process definition detailed, Triggers,
  inputs/outputs
• Tasks

24
Data Gathering Tool
25
Interviewing and Mapping

• Ground rules
• Buy-in, time, privacy, tone, listen
• Mapper and recorder roles
• Select the right people

26
The Map

• Supplies
• Sticky notes, felt tip pens, poster sized sticky
  paper.
• People in columns chronologically
• Time top to bottom
• Action verb/noun on post-it
• Basic symbols
• Cycle times

27
(No Transcript)
28
Hands On

• Exercise 5 Process Mapping Basics
• Exercise 6 Process Mapping Basic Symbols
• Exercise 7 Process Mapping Verb/Noun Format
• Exercise 8 Process Mapping Complete Map

29
Into the editing room

• Inputs, outputs, and waste
• Surprises
• Invisible consequences
• Process ownership
• Objectives, risks, controls
• Measures of success

30
Analysis tips

• Remove approvals
• Looping errors
• Isolate delays, rework, handoffs
• Follow the forms
• Incomplete maps dangling actions, unanswered
  questions
• Question hold files
• Look at cycle times

31
Finalize the project

• Look for areas to add value
• Business value improve efficiency,
  effectiveness, or provide economies
• Customer value
• Present conclusions and recommendations

32
Pitfalls and traps

• Were drowning in information and starving for
  knowledge
• Mapping for mapping sake
• Round and round up and down
• Failure to finalize
• Letting the clients define the process
• Leading the witness
• Verifying the facts
• Do not forget the customer
• No tool is an island

33
RACI Matrix

• Responsibility Charting

34
RACI Matrix Responsibility Charting

• A technique for identifying functional areas, key
  activities, and decision point where ambiguities
  exist.
• Management actively participates in the process
  of systematically describing activities,
  decisions that have to be accomplished, and
  clarification of the responsibility that each
  plays in relation to those activities and
  decisions.

35
RACI - Benefits

• Assists work teams in charting roles and
  responsibilities
• Clarifies individual/departmental roles and
  responsibilities
• Identifies accountabilities
• Eliminates misunderstandings, encourages teamwork
• Reduces duplication of efforts
• Establishes consults and informs resulting in
  better communication misunderstanding

36
RACI Matrix - Guidelines

• Look for improved efficiency and economies
• Eliminate checkers checking checkers
• 100 accuracy not always required
• Place accountability (A) and responsibility (R)
  at the level closest to the action or knowledge
• There can be only one accountability per activity
• Authority must accompany accountability
• Minimize the number of consultants (C) and
  informs (I)
• All roles and responsibilities must be documented
  and communicated.

37
RACI Matrix - Explainer

• A Accountable The buck stops here
  position with yes/no authority. Only one A per
  function.
• R Responsible The doer Position working
  on the activity. Responsible for
  action/implementation. Degree of responsibility
  determined by individual with the A.
• C Consult In the loop Position involved
  prior to decisions or action - two-way
  communication.
• I Inform Keep in the picture Position
  that needs to know of the decision or action
  informed after incorporates one-way
  communication.

38
RACI Determining Responsibilities

• Exercise 9

39
RACI Matrix Development Process

• Develop decision /activity list - (tasks action
  verbs)
• Develop function lists (position assigned to an
  activity or sub-activity)
• Agree on function definitions
• Output in a responsibility chart
• Agree chart with key individuals
• Circulate

40
RACI Chart Example

41
RACI Vertical Analysis
Lots of Rs does the individual have too much
work No empty spaces does the individual need
to be involved in this many activities. Are they
a gatekeeper? No Rs or As should the role be
eliminated? Too many As is there proper
segregation of duties? Is this a
bottleneck? Qualification - Does the type or
degree of participation fit the qualifications of
the role?
42
RACI Horizontal Analysis
No Rs is the job getting done? Too many Rs
is this a sigh of over the wall activities?
Just get it off my desk? No As Why note? Who
is accountable To many As Is there confusion?
Who is doing what? Too few As and Rs Is the
process slowing down while activity is performed
on an ad hoc basis. Are procedures outdated
and need to be streamlined. Lots of Cs are
they necessary Lots of Is should this be
standard or only on an exception basis. All
boxes full Too many people involved.
43
RACI Matrix - Practice

• Exercise 10 Expense Reporting RACI Matrix

44
Customer Mapping

• There is only one valid definition of a business
  purpose to create a customer.
• Peter Drucker
• the Practice of
  Management (1954)

45
Customer MappingIdentifying Jobs the Customer
Wants to Get Done

• A business is defined by the want the customer
  satisfies when she buys a product or service
• Peter Drucker

46
Identifying customer jobs

• When the business focuses on the jobs the
  customer is trying to get done, they can develop
  innovative solutions to satisfy those jobs.
• Asking customers what they want is not
  necessarily going to provide you with a good
  definition of the job they want to do.
• When Apple developed the Ipod, they defined the
  job the customers wanted done as managing their
  music, not a better music player. The focus is
  on the job not the solution.

47
Customer Mapping

• Process Mapping focuses on the Companys
  Processes but what if those processes are not
  producing outcomes the customer desires?
• Customer Mapping focuses on the job the customer
  is doing, the tasks the customer must do to
  accomplish the job, and the customers measures
  of success.

48
Customer Mapping the process

• Define the job
• Define the tasks the customer must perform
  (verb/noun)
• Define customer inputs and outputs
• Define the customers measures of success
  (minimize/maximize)
• Rank the measures of success
• Compare results to the measures
• Look in depth (Process Maps) for areas that do
  not measure up
• Exercise 11 Group Exercise - Complete a
  Customer Profile Worksheet

49
Customer Profile Worksheet
50
Spaghetti Map

• As Is and To Be

51
Spaghetti Maps

• While traditional flow charts or process maps may
  be used to identify control points, spaghetti
  diagrams can be used to quickly identify
  inefficiencies.
• Interview employees to determine the process
  flow.
• Document the As Is process flow using a
  narrative and nodes to symbolize the movement of
  key items through the process.
• Document the To Be process by eliminating some
  of the steps in the process which might create
  efficiencies.

52
Spaghetti Map - Example

Exercise 12 Create a To Be map
53
Spaghetti Map To Be

• Exercise 12
• Create to To-Be Spaghetti Map of the Employee
  Expense Reimbursement process using everything
  you have learned about this process or
  information you know about other processes that
  are more efficient.