Internal Auditor’s blogs reflect the personal views and opinions of the authors. These views may differ from policies and official statements of The Institute of Internal Auditors and its committees and from opinions endorsed by the bloggers’ employers or the editors of Internal Auditor.

The System or the Process

Comments Views

​From time to time, I'm approached with questions about what internal audit workpaper system is the best, which enterprise risk management software to purchase, or which budgeting application to use. My typical response is to ask a series of questions to understand their objective for purchasing the application. Before discussing any recommendation, it is important to have a greater understanding of the specific goals in order to chat about which solution may be right for them.

While I'm often the first in line for any cost-effective software/applications that will make our processes more efficient and effective — and there are definitely some great solutions available — I find there are cases when this question stems from wanting an easy fix. While there are systems and tools that can help in addressing process problems, they are not necessarily silver bullets. For example, you can find software that will assist in scoring and quantifying risks, but it will only be effective if there are methods for collaborating with the business to understand risks to the organization, capturing those risks, understanding any qualitative factors that may impact the risk, and ultimately having a mechanism to update the risk assessment on an ongoing basis. 

Another important consideration is determining which solution will be best for the organization versus the individual preferences of the application's users. Also, consider how that solution will be rolled out across the organization — including any training needed. I can think of several recent examples in which I've talked with individuals at various organizations that have had multiple implementations of applications that were effectively designed to address the same issue. In these situations, the applications were typically associated with an individual who was the "champion" for using that particular application. In some cases, when the champion left the organization, the organization looked to find another solution versus determining how to move forward with what was already in motion.

While automation can potentially make any process more effective, it is the underlying process that makes it successful. Evaluating existing systems and needs, establishing roles and responsibilities, reviewing timelines, providing training and feedback on what is expected, and holding individuals accountable are all critical to ensuring success, regardless of whether a process is automated or manual.

Internal Auditor is pleased to provide you an opportunity to share your thoughts about these blog posts. Some comments may be reprinted elsewhere, online or offline.



Comment on this blog post

comments powered by Disqus
  • CRMA-Launch-October-2021-Blog-1
  • All-Star-Conference-October-2021-Blog-2
  • IT-General-Controls-October-2021-Blog-3