Background:
From smaller organizations to larger ones, all require smooth flow of processes whether core ones or ancillary processes. A small disruption in the flow of any of the processes may result in multiple consequences which would affect not just the flow of that particular process but also other linked processes. Such disruption in a process may occur due to various reasons. One such example is that the payroll system used for calculating payroll of employees is facing technical issues during payroll period and hence the salary cannot be processed and paid to the employees.
This may cause a small disruption which can be easily identified and resolved, however there may be some issues which can be much more complicated and cannot be easily identifiable and hence the organization may face a tough time dealing with such issues. Further there may be some issues which may carry high monetary losses to the organization, for example there might be issues in the feedback system maintained by the management regarding after sales service and hence customers after not getting their issues resolved may not buy products from the company. Such issue may become difficult to identify and even though it is easier to resolve the same after identification.
Such kind of disruption across an organization requires to be identified and managed by doing various tests, scrutiny, procedures, analysing the processes in detail, performing advanced techniques and much more. Such steps even though taken by management, would normally be reactively taken as a response to the happenings in the organization and could not recover the loss the organization has incurred either financially or opportunity wise. Hence to avoid such losses or to minimize them to a larger extent, professional help should be taken by the organization.
Internal Audit’s role in curbing the same:
An Internal Auditor is a professional who has proper knowledge of the industry related processes, the normal issues faced by the organizations and importantly how to identify the areas where there might be escalations in near future. Also the involvement of internal auditors in multiple industries help them use different techniques which were successful in the said industries.
The range of techniques the internal auditors possess helps them identify the issues to be resolved much more easily and also help in solving those issues more efficiently and effectively. These techniques range from basic vouching of documents and verification to business process improvement and process audits.
If the techniques are carried out properly then it would help the organization in leaps and bounds not only by identifying the issues but also by identifying other risk prone areas which may be potentially cause an organization to sink further if not fixed.
Basic Internal Audit Process to manage disruption:
For smaller organizations where there may not be much complexity involved in processes, some basic tests or audits can be conducted to check for issues in the processes and subsequently resolve them. Following is a basic overview for the same:
1. Conducting Audits for areas where there is disruption caused as specified by the management:
Such Audits may include basic checking of pre-decided areas on a superficial point of view to draw inferences and helping management identify the point of disruption.
2. Doing a walkthrough of a particular process to identify any hiccups:
A basic approach to identify any disruptions is to do a proper walkthrough of one process right from the start to end and then finding out where there possibilities of unusual halts.
For example: If there are constant customer complaints regarding late deliveries of products, a proper walkthrough of delivery process should be done so as to find out what is the normal delivery time and why there are deviations from the same. By doing this we can identify the root cause and also help in improvement points for the process at the same point of time.
3. Performing surprise audits to check diligence management:
Although not so effective but surprise audits can be at times helpful as it may check if the processes are faulty due to implementation issues.
For example: In the same example from point 2., we can conduct a surprise of the delivery process for a particular step, say shipping, and check as to whether the shipping personnel are diligent in doing their work and if not then whether because of the said issue there is disruption in the delivery process.
Above were some basic audit processes or checks an internal auditor can do proactively or if said by the management reactively to identify the issues causing disruption in the organization. However, we can see that the can be conducted or performed only to identify basic level issues which are normally present in smaller organizations due to lack of proper reviews or checks present internally. Also such checks can be done even internally by the management if they are skilful enough and does not requires much involvement of internal auditors.
For larger organizations, there are issues which may cause disruptions and are normally easily identifiable and even though identified, resolving the same may require high order of thinking taking into account many parameters and hence it requires special attention as such areas are normally of higher importance to the management. Such issues mandatorily require assistance of a professional and hence internal auditor is of paramount importance in such situations.
Internal Auditors may apply techniques according to the nature issue and hence finding the core nature is essential to the internal auditor. Once the same is identified there are numerous points to be taken into consideration so that fixing one area does not negatively affect other areas.
Internal Auditors use many techniques to identify such areas which causes disruption across the organization. Following are some of the well-known techniques:
1. Business process management:
One of the most trustable approach is managing disruption and streamlining processes in an organization is called as Business Process Management. Business Process Management is the discipline in which various methods are used to discover, measure, analyse, model and optimize business processes. BPM majorly focuses on processes of an organization and curbs and disruption causing across the organization due to issues in the processes. It is a continuous process that can be lead to improved business outcomes over time. BPM can be done either using automation or traditionally.
Following are the steps to be followed for applying BPM using the traditional approach:
a) Understanding of current processes: Initially you have to analyse how the business process currently flows across the organization and a proper documentation shall be done of the same.
b) Finding out inefficiencies or OFI: After a proper documentation is done of the existing processes, a proper brainstorming session is carried out and several points are considered wherein there are scope for improvements and also whether the processes are done in a proper way as per industry standards and the same is discussed with the management. After management agrees affirms to the improvement points, further steps are carried out.
c) Execution: After the management’s nod regarding the changes or tweaks in the current business processes, the same is implemented at the ground level and further the respective personnel are educated and trained regarding the same. Only after the personnel are familiar with the change, the same can be made effective.
d) Monitoring and checking if the problem is solved: After execution is completed the auditor needs to constantly monitor if the change is properly implemented and also whether the problem arising earlier is getting resolved.
In conclusion, BPM helps in proper scrutiny of business processes and helps in identifying and managing disruption across the organization if the same is being caused due to process failure or process inefficiency.
2. Risk Control Matrix (RCM):
Risk Control matrix is a powerful in identifying any leaks in the organization by applying controls in each process and testing the same. In RCM, a particular process is taken and various controls are applied on each checkpoint of the process and further, the controls are tested to find out the potential risks in an organization if the following control is failed leading to disruption in the organization.
Following are the steps to draft a suitable RCM in an organization:
a) Understanding of processes: An in depth understanding of processes is done, firstly from the management verbally and then by actually going through each and every step in the process in detail right from the ground level.
b) Drafting of process and identification of risks: After understanding the process the same is drafted for reference of the auditor and then a proper analysis is done so as to identify the risks involved in the processes if the same are not carried out properly.
c) Drafting of Controls: After the relevant risks are identified, the same are then categorized based on their effect on the organization and then suitable controls are drafted.
d) Submission and implementation: After the matrix is drafted the same is then submitted to the management and then after approval is obtained from the management the matrix is then implemented.
e) Testing: Once the controls are applied, a testing of the controls should be done as to whether the employees are adhering to the same and also if the controls are relevant over the period of time. This testing should be done after a reasonable period so as keep the purpose of testing valid.
To conclude, we can say that an RCM can be of great use to the auditor in identifying anomalies in the organization and the same can be done in a proactive way so that potential disruption can be avoided.
Apart from above tools or techniques, there are numerous other ways in which the internal auditor can help scrutinize the businesses of the organization and help in finding out the reason behind the disruption in the organization.
Many a times the disruption so caused can turn fatal to the organization in the near future as it won’t look much material at present but in the background it is shaping to be more and more disastrous in the future.
Hence we can say that internal audit is essential for an organization not just to fulfil the legal requirements but to keep a detailed check on the organization’s health. So we can conclude that internal audit is a health check-up for the organization which keeps it rest assured about its operational health over a long period of time.
*****
Authors: Umesh Vishwakarma, Director, and Swapnil Pawar, Associate Consultant, can be reached at [email protected] or +91 98709 25375.
Author Bio
