Internal auditors and other professionals increasingly are focusing on improving processes in their organizations. Indeed, the growing process improvement literature emphasizes the concept of "continuous improvement" because there seemingly are endless opportunities to make processes better. Process improvement introduces change, and that change may come out of a wide variety of quality, compliance, and improvement initiatives. Although some of these programs vary in their approaches, and some result in certifications and opinions being issued, many of their fundamental methodologies are similar.
An inquisitive, analytical internal auditor who is attuned to the processes being examined can identify processes that can be improved significantly. These recommendations can come from a variety of audits, including operational, compliance, and risk and control reviews. Moreover, process improvements can be discussed in the same breath as benchmarking, lean engineering, reengineering, or following best practices.
Methodology and Tools
The core components of a process improvement methodology are identifying the process to be improved with a focus on performance gaps and disconnects, analyzing the findings for practical solutions to improve its efficiency and effectiveness, and recommending improvements. Auditors often use the inquiry process to gather information, which may provide enough data and input to identify, analyze, and formulate a workable solution for improving a process.
A flowchart is another tool used by auditors. This graphical and symbolic representation of the processing steps can provide a better understanding of processes, grant visibility into compliance issues, and make shortcomings more apparent.
A third approach is identifying patterns that point to an issue that needs to be addressed. Tools such as the sort capability in spreadsheet software enable auditors to identify patterns more quickly. Auditors also can import data from their organization's enterprise resource planning (ERP) system into a spreadsheet and sort that data in ways that reveal patterns meriting closer scrutiny.
Areas for Inquiry
An astute auditor with a common-sense grounding and solid skills easily can identify and analyze a process that results in a significant process improvement. The methodology and examples that follow demonstrate that looking for, finding, and recommending changes touches nearly everything internal auditors do.
Sources of data on product rejects can come from quality control reports as well as sales returns. An internal auditor can examine both sources and look for patterns. For example, a significant finding at a manufacturing company revolved around prefinished panels to be used on the walls of mobile homes or family houses. One audit revealed a high number of returned panels because the surfaces were damaged when unbundled for installation. The auditor inspected some panels and then discussed the damaged panels with plant personnel. He learned that the drying process was inadequate; panels weren't quite dry and stuck to each other when bundled. The auditor discussed the drying process with the production foreman, who devised a solution that added another short drying oven adjacent to the existing one in the production line. Reviewing the documents for patterns and inquiring about how the process actually worked helped to identify the problem.
Reviewing the safety of a manufacturing plant is easy if the data is stored in ERP software. Auditors can download the accident reports into Excel and sort by plant and accident category to reveal patterns that have led to worker injuries. For example, an analysis of one global manufacturer revealed numerous employee injuries such as broken bones, sprains, and abrasions at one of its plants. Accident reports blamed the injuries on slippery floors. When the auditor inquired about the problem at headquarters, management admitted that this particular plant was the most chaotic in the organization and headquarters had been slow to take corrective action. After the auditor brought this issue to light, management stated it would make this issue a higher priority.
When oil and gas companies can't locate payees that are due revenue from producing wells, the funds are placed in a suspense account. An internal auditor at one oil company identified approximately US $48 million being held in suspense, largely due to "address unknown" coding. Upon further review, the auditor noted numerous big oil and gas companies were included in the suspense account. When organizations can't locate the address of a company like Exxon/Mobil, it is likely that the business unit does not have competent management. Under a management change, this department formed a small task force for approximately six months that reduced the US $48 million to $17 million. When the task force was disbanded, management more closely monitored suspended funds by each analysts' area of responsibility.
Financial Closing Schedule
Some large worldwide service corporations have gone through multiple restatements in recent years, which should be a red flag to an internal auditor. One company could rarely close its books on time — even then the close wasn't a hard close, and the controller continued to allow the books to be reopened. Through inquiries, the internal auditor heard complaints that company divisions around the world wouldn't submit required closing data timely, which was verified by the accounting directors. The auditor recommended that the controller or chief financial officer (CFO) provide a detailed financial closing accounting schedule, enforce a firm closing date, and discontinue reopening closed accounting periods. During this U.S. Sarbanes-Oxley Act of 2002 review, the auditor also recommended that the CFO revisit the tone at the top with the CEO and the board to ensure schedules were met and performance evaluations reflected general managers' and division controllers' work performance. This lack of tone at the top, plus additional Sarbanes-Oxley findings, resulted in the termination of the company's CEO and CFO.
Bid Solicitations and Vendor Audits
The vendor bidding process is part of most organizations' audit coverage. If an organization doesn't go out for bids, it may not get the best price for the quality of goods and services that it is seeking. Requests for proposals should be embedded in the organization's policies and procedures manual. Similarly, monitoring and auditing the vendor's invoices is necessary to ensure that the organization is actually being charged the bid price. When auditing a vendor, the auditor should request to see all bids that the organization received for the goods or services being requested. The auditor then can observe whether the organization followed procedures to obtain competitive pricing. If it did not accept the lowest bid, the auditor should ask why. An organization may reject a bid because the vendor has supplied poor service in the past or has a reputation for lower quality services. Frequently, vendor audits reap significant rewards for an organization, both in dollars recouped and processes improved.
Major Construction Projects
Major construction projects often have cost overruns. Auditors should review the bids or cost-plus documents carefully. Moreover, they should be aware of the "double dips" that can come back through as an "extra" or "change order" billing and understand that materials left on site mean credits are due for returns. Also, they should examine what is included in direct and indirect charges, because some contractors duplicate bill job classes of labor, so that an item that is included in the contract as an indirect charge also has a direct charge.
Call Center Scheduling
Call centers have emerged as an essential component of the customer service relationship strategy now widespread among companies. A few years ago, a small online travel company asked its internal auditor to examine the effectiveness of a call center with 36 customer service representatives. The call center was open 12 hours a day to accommodate the different U.S. time zones, and its employees had flexible hours, 30-minute lunch breaks, and 15-minute breaks in the morning and afternoon. The company used sophisticated software that reported the volume of calls during every half-hour increment, dropped calls because of too much waiting time, and average duration of calls. The data wasn't particularly flattering, especially the number of dropped calls during peak times. Amazingly, although the call center director had this information, knew the peak hours, and realized he had to stagger schedules, dropped calls remained too high.
The auditor asked to examine the daily staffing schedule and inquired about the tools the director used to create the schedule. To the auditor's astonishment, the director said he just looked at the data and let his gut help him build the daily schedule. That evening the auditor downloaded a trial version of scheduling software for call centers. The next day he loaded the data with the variables specific to the company and printed out a vertical color bar chart that optimized the scheduling process. To handle the call center efficiently, the director needed to hire one additional call representative. Common sense, inquiry, and a little innovative thinking were all that was needed to improve this process.
Food Service Work Flow
How many times have you walked away from a restaurant at lunch because the line was too long? Some of the managers of these restaurants majored in hotel and restaurant management in college and received training at corporate headquarters, so they should have learned that efficient work flow during peak hours maximizes revenue. In assessing the adequacy of restaurant managers, a traveling field auditor should ask: Where are the logjams in the serving line? Are there enough cash registers? Are tables bussed fast enough? To serve customers better, the restaurant could respond to findings raised by these questions by adding personnel at slow points in the serving line, such as in making salads; adding another cash register at the end of the line to relieve a slow check out; and ensuring that there are sufficient personnel to bus tables instantly so that customers are seated promptly.
There are many tools that internal auditors can use to evaluate processes. For example, studying both The Committee of Sponsoring Organizations of the Treadway Commission's Internal Control–Integrated Framework and Enterprise Risk Management–Integrated Framework may suggest processes that haven't received close scrutiny previously from audit professionals, such as inbound and outbound activities, operations, marketing, services, and distributors.
Efficiencies gained through process improvements can add value for organizations of all sizes and types. Small startup companies almost always need assistance in establishing effective processes, while large companies that expand without controlled growth often have significant needs to ensure their processes are efficient and under control. As such, the need for internal auditors to provide their expertise to improvement efforts will likely continue for many years to come.