10 Practices to improve business processes
Internal audit can have a huge impact on enhancing business processes.
In their quest for internal audit to contribute to business success, corporate leaders increasingly want auditors to help improve business processes. Deloitte’s 2017 Ready for the Spotlight publication notes that CEOs, chief financial officers, and other business leaders “want advice on risks and risk management, and insights into business operations and processes.”
Similarly, internal audit stakeholders say consulting on business process improvements is the top area where internal audit can provide advice, according to The IIA Research Foundation’s 2016 Internal Audit Common Body of Knowledge Stakeholder Report. Internal audit can adopt several practices in approaching high-impact business process improvement projects.
1. Select the Right Processes
Internal audit can start process improvement efforts by selecting the business areas where it can add value. As with many audit-related activities, a risk-based approach is the best way to select areas for improvement projects. This approach includes selecting processes that are critical for accomplishing the organization’s strategy, selecting complex processes that cross functional lines, and selecting processes where there is a general consensus that there is a need for improvement.
To select operational processes that are critical to accomplishing the organization’s strategy, internal audit should ask: Is this process critical to the business’s mission? If this process is inefficient, does it matter to achieving the organization’s goals? If the answers to these questions are “no,” then spending time in this area is unlikely to drive significant benefits to the business, and management may not consider this type of project impactful.
Selecting complex processes that cross functional lines enables internal audit to assist with problems that are difficult for one function to resolve. Functions that are upstream may not realize they are doing things in a way that causes problems for functions that are downstream. Conversely, individual business functions are more able to self-assess and solve problems with processes that are performed within their area.
If a cross-functional effort is needed, internal audit can assist different departments in coming together to improve a process. Likewise, a complex process may be difficult for the process owner to analyze without assistance. Internal audit can assist a process owner in taking a fresh look at a complex process.
A consensus that a process needs improvement can assist in getting support for the project and the buy-in needed to motivate the function’s managers and team members to collaborate with internal audit to drive change. For example, at an aerospace manufacturer, there was a consensus that the procurement process needed improvement. Senior management could see excess inventories building and material purchase costs were exceeding budgets. However, there was no agreement about the cause of these issues. Additionally, because the procurement function was critical to achieving business goals, the procurement process was a prime area for internal audit to perform an advisory project.
2. Enlist an Executive Sponsor
Even with consensus that a process needs improvement, project teams frequently encounter resistance to change from some process participants. These individuals often believe someone else needs to adjust — not them. Internal audit can help overcome this resistance by enlisting executive sponsors who are highly interested in seeing the process improved.
In the aerospace company, both the CEO and general counsel served as executive sponsors for internal audit’s procurement process improvement project. These executives played an informal role and did not participate in project meetings or the project process. However, their interest in the project and desire to improve the procurement process became invaluable in leveraging the project output to drive change.
3. Staff the Project
Audit teams need to have the right skills to perform insightful business process analysis and complete improvement projects successfully. The team members must have strong business acumen and the ability to add value for the business process. Audit leaders should consider using just-in-time training to give the team members the most current knowledge possible of the subject area to be audited.
For complex and specialized areas, audit teams should bring in subject-matter specialists from within the organization or through service providers. For example, the aerospace company’s chief audit executive (CAE) used a combination of internal auditors with significant company experience and a contributor from a service provider who brought data analysis skills that the internal team did not possess.
Finding the right skills within the organization can save costs, but such employees must be independent of the area being reviewed. Just as independence is critical for assurance projects, it also is important for advisory projects to ensure specialists take a fresh look at the process.
4. Establish Benchmarks
Setting benchmarks for the area selected for improvement gives internal audit a measuring stick to use throughout the project. Questions to ask include:
- What are the performance standards for the operations of this area?
- What are the best practices for this function?
- What are the key perform-ance indicators?
- How should the function measure success?
At the aerospace company, internal audit began its project by benchmarking its practices against other procurement functions. In addition, the auditors leveraged resources such as manufacturing forums and functional publications to identify improved practices for all significant procurement processes from requisitions, to soliciting bids, to certifying suppliers, to establishing master agreements, to creating purchase orders and rating suppliers.
5. Identify Improvement Opportunities
Performing gap analysis and process analysis enables internal audit to identify inefficiencies, non-value-added tasks, and other opportunities for improvement. In gap analysis, the objective is to identify the areas where there is a gap between the actual performance of the function and the benchmark. Gap analysis can be performed by gathering policies, key performance indicators, and interviews on practices and then comparing the actual practices to the benchmark.
For process analysis, flowcharting is a good approach to identifying opportunities for improvements in process efficiency and control design. The goal is to not only have an efficient process, but also have efficient design and placement of controls. Often, organizations add controls as a process evolves. In these situations, the controls tend to be an afterthought and as a result, the controls are manual and occur at the back end of the process.
Throughout process analysis, internal audit should continually ask:
- Has there been appropriate use of technology?
- Have processes and controls that can be automated, been automated?
- Can the process be streamlined?
- Can controls be moved from the back end of the process to the front end?
The aerospace company’s internal audit function found several opportunities to improve procurement processes. For example, it discovered that some purchase orders were being issued without final engineering specifications and negotiated firm prices. Additionally, the procurement function was not benefiting from the negotiated prices in the established master agreements and blanket purchase orders it had established.
6. Test Transactions
As with an assurance project, most process improvement projects should include tests of transactions and the effectiveness of controls. The difference with a process improvement project is that there is additional focus on assessing not just control effectiveness but also process effectiveness, cost, and efficiency.
Testing should include performing data analysis and collecting empirical support for all issues identified. These efforts should provide convincing statistical evidence to support the issues to be included in the project report. If internal audit cannot develop convincing statistical support for an identified issue, the team should ask whether the issue really is significant.
At the aerospace company, the purchase orders issued without firm prices and without final engineering specifications took on added significance when the team quantified how frequently this was occurring. The data analysis indicated that the problem involved a surprisingly high percentage of purchase orders.
7. Understand Root Causes
For each issue, the internal audit project team should drill down past the surface problem to understand the root cause. Determining the root cause of an issue may require substantial analysis, involving considerable time and effort. In many cases, management already may be aware that an issue exists. The project adds value by providing a solution to the root cause.
At the aerospace company, internal audit analyzed why the procurement function was not providing engineering details and negotiating firm prices for so many purchase orders. The surface answer was that buyers were not performing their responsibilities appropriately. But the root cause was far more complex. The company’s end customer was not providing sufficient engineering details for the final product timely. Another contributing factor was the long lead time needed for suppliers to fabricate some parts being procured.
As a result of these and other root causes, the procurement function did not have the engineering details available to provide to the vendor and did not have sufficient information to negotiate a final price. The procurement function’s buyers could not solve these root causes on their own. In fact, the buyers were frustrated by this problem. Procurement needed additional and more timely information from the customer. To obtain this information, procurement needed assistance from the sales and contracting functions, as well as business-unit leaders.
8. Create Solutions
Once the project team has identified the issues, the next step is to develop solutions. Some internal audit functions develop recommended solutions and present them to the process owner. A better practice in process improvement projects is to work with the process owner to gain buy-in and agreement with the root cause analysis and to build an action plan together to address the root causes.
The aerospace company’s internal audit function worked closely with the procurement process owners to gain their agreement on the root causes and to jointly develop the solutions. For the issue that involved getting more timely engineering specifications from the customer, the action plan included enlisting the support of the other functions needed to solve this problem, such as sales, contracts, and business-unit leaders.
9. Tell the Story
The best approach to reporting on process improvement projects is to keep the report succinct while still telling the business story. As with any communication that auditors want executives to read, the business process improvement report should be concise.
In building the report, internal auditors should start with the most important issues first. If the report doesn’t begin with the headlines, the reader may never get to its most important issues. Auditors should prioritize report issues using the lens that management uses — not a compliance or audit perspective. Another good practice is to provide a one-page executive summary. Using a PowerPoint format rather than a Word document may be more effective, depending on the audience.
Auditors should make the corrective action plan an integral part of the report so that they not only explain the root causes of the issue, but also provide the steps to resolve the issues. In many cases, auditors can structure the report so that the main focus and format is the corrective action plan. This approach also can help strengthen internal audit’s reputation as a business partner.
The audit department at the aerospace company included a short executive summary at the front of its report about the procurement review, which highlighted the 10 most important issues and stated the planned corrective actions. The detailed report provided additional information about those issues and also included other issues that were important to communicate.
10. Manage the Message
When internal audit is close to issuing a project report, it should have face-to-face meetings with the executive recipients of the report. No matter how well the report is written, this personal interaction can aid in making sure the message is communicated accurately. These meetings are an opportunity to build closer relationships with business leaders.
For the aerospace company’s procurement project, the CAE held multiple discussions with the management of the procurement function and met with the CEO and general counsel who had been the executive sponsors. The report and meetings helped these executives understand the project results and the significance of the issues. As a result, the CEO tasked the leader of the business unit and the procurement function with carrying out the action plan.
The business-unit leader was best placed to address the customer-related issues as well as other issues that needed executive support. The procurement leader and business-unit leader laid out a time line and worked together to carry out the action plan. The CEO asked the procurement leader to provide regular updates on the status of the corrective action plan. Both the CEO and general counsel participated in these status meetings and helped to keep a focus on making progress. Over time, the procurement function implemented the corrective actions, and the project led to substantive positive change in the company’s procurement processes.
Improvement Advisors
Internal audit’s independence, process analysis skills, and knowledge of the organization’s procedures and operations create the perfect mix of talents needed to provide high-quality process improvement services. Because the audit function is already intimately familiar with the business, it can get to the root causes quickly and offer advice that is tailored and specific.
