Producing Value-added Results Using Process Analysis Techniques
Having had the pleasure of consulting with business managers and internal auditors for almost 20 years, I've noticed some definite trends concerning business managers' expectations of internal auditors. Today's business managers expect their internal auditors to perform audits and, at no extra cost, to come up with some useful ideas that will help the company minimize its costs, increase its profits, and meet or exceed the business goals. Essentially, business managers expect a lot. Consequently, savvy internal auditors make it a priority to develop value-added results while performing cost-effectively. To this end, these auditors have adopted risk-based process and operational auditing and have added consulting or advisory services to their scope of services.
Admittedly, it's very difficult for an internal auditor to exceed a business managers expertise and knowledge of an operation or process. Let's face it, the business managers have been working in their area of expertise for most, if not all, of their careers, while the internal auditors have spent time auditing myriad entities, operations and businesses. How can internal auditors hope to develop the types of value-added results that will be appreciated by business managers? The answer is to incorporate process analysis techniques in the audit methodology.
What's the Benefit of Analyzing Processes?
As the name implies, process analysis means studying and examining the series of functions and tasks that constitute a process and produce a desired business result or output. The objective of process analysis is to identify opportunities for improved efficiency and overall performance. Process analysis is a systematic technique that enables you to easily:
Gain an appreciation of the scope and nature of the work performed by departments within an organization,
Identify the risks which threaten the achievement of business process objectives,
Determine areas for potential operational improvement,
Troubleshoot recommended process or procedural changes prior to implementation,
Refine the scope of an audit by targeting only those areas of highest risk and deploying audit resources accordingly.
Process analysis begins with defining the process' scope and business objective, and includes acquiring a comprehensive understanding of the process's performance trends and external competitive environment. While some efficiency can be gained from performing a function or task analysis, the greatest gains occur when an entire process is analyzed because you acquire a more useful, broad perspective and can more easily identify the root causes of problems.
Once the process scope is determined, i.e., the delineation of a process's starting point(s) or input(s) as well as the ending point(s) or output(s), the next priority is to acquire an understanding of how the process operates currently. To do this, you should:
Review the organizational charts for the departments involved in performing the process to determine whether the process is performed in a decentralized or centralized way.
Examine the strategic and current business plans and assess the progress against these plans.
Create operational and systems flowcharts for the functions that comprise the process or review ones that have already been created by those that perform the work.
Analyze financial and other management information reports to get a sense of peak performance periods, transaction and dollar volumes, staffing levels, and performance trends.
Read pertinent trade journals and use the Internet to research and gauge the competitive environment and industry challenges and priorities.
Interview the process's Senior Management to obtain a strategic perspective on the process.
You need to ensure that your initial research and interviewing efforts target the appropriate level of information required to obtain an overall understanding of the business objectives, the process's major functions, major systems, key relationships, interdependencies, how revenues are generated, key growth trends, market trends, etc. Obtaining this information is critical if you want to understand the process and be able to make useful, value-added recommendations for increased operational efficiency. If you collect too little information, you will find it difficult, if not impossible to draw accurate conclusions concerning the process. If you collect too much information, you'll drown in a sea of unnecessary detail and waste valuable time and effort. The level of detail should be sufficient to permit you to identify the major risks that threaten the achievement of business objectives and to permit a cross-functional walk-through to verify the accuracy of your understanding of the process.
But Just What is a Process?
Perhaps the most challenging aspect of process analysis is determining exactly what a process is and how processes differ from functions or tasks. I know from experience that the act of defining processes is a stumbling block to the adoption of risk-based process auditing for many audit departments.
Thanks to Frederick Taylor and his scientific management approach, we are all familiar with functional, departmental, hierarchical organizational structures. We can easily list the core functions within a business: sales, marketing, customer service, accounting, finance, operations, systems, etc. And, we use these functional, departmental divisions to determine the number and types of audits to be conducted during the year. However, functions and departments are not processes.
Consider the process of making an unsecured loan. A number of departments and functions can be involved in this endeavor, depending on the lending institutions organizational structure. The process actually begins with some selling activity and the submission of an application, complete with pertinent financial information. The sales activity can be direct, in-person sales performed either in branches or regional centers, or a department of telephone marketers could generate the sales. A centralized credit department or decentralized regional lending officers may approve the loan application. Once the application is approved, the account needs to be set up on the processing system, the loan check needs to be generated and mailed out, and the entire transaction needs to be recorded so that the reserve amounts and financial statements are correct. Depending on the organization's size and structure, the unsecured lending process could involve three or more departments.
In contrast, a function is a subset of a process. Within the unsecured lending process, financial statement analysis is a function, typically performed by the credit department. Another function that constitutes the unsecured loan process is issuing the loan proceeds check, an activity that is typically performed by the check-processing department. Typically, functions are performed within departments and require no cross-functional effort. The functional outputs and concerted efforts across departmental lines are what produce a processs results.
Michael Hammer and Steven Stanton, in their book, "The Re-engineering Revolution", define processes as being cross-functional and results-oriented. According to Hammer and Stanton, "Processes have specific inputs and outputs, and relate to customers and their needs, either directly or indirectly." I differentiate between processes and functions by defining processes as series of activities that produce outputs that are valued by the business constituents. These constituents may be customers, employees or shareholders. Processes correlate directly to the business' mission and purpose, and produce results that are congruent with this mission and purpose.
Functions are the subsidiary steps needed to produce a process result. Essentially, functions are the subsets of processes. Examples of functions in the unsecured lending process are underwriting or credit approval, loan review, credit checks and verification, and application processing. In the claims process, examples of functions are claims registration, updating loss reserves, claims investigation, and quality assurance. A function typically has the following four attributes:
Attribute #1: Like a process, a function has a discrete starting point and ending point as well as specific inputs and outputs. However, these starting and ending points typically originate within the organization.
Attribute #2: A function can occur either independently of or simultaneously with other activities.
Attribute #3: A function consists of multiple and distinct activities or steps, however, these steps are usually of a detailed, procedural nature.
Attribute #4: The activities, which comprise a function, are typically the responsibility of a particular person or work team.
Four Guidelines for Identifying Processes
My clients frequently ask me to provide them with an empirical list of processes for their organization. Unfortunately, no such list exists. However, you can use the following four guidelines to distinguish processes from functions and tasks, and create a list of core processes for your institution.
Guideline #1: A process's result or output is typically one for which the company receives payment. For example, claims payments, payroll processing, and lending are processes; accounts receivable and accounts payable are functions. Insurance companies receive premium payments from their insureds, who expect that claims, if incurred, will be paid timely and accurately. Employees, an internal business constituency, work for companies with the expectation that they will receive timely and accurate paychecks. Banks make loans as a source of interest income, assuming of course that the customer doesn't become delinquent. No company receives payment for maintaining the accounts receivable or accounts payable ledgers, unless of course the company is an accounting firm. But, even in the case of accounting firms, their customers are paying for the process of financial statement preparation, not simply the entering of data into the general ledger.
Guideline #2: Inputs to processes typically originate outside the entity. If we return to the example of the claims process, the starting point occurs when the insured submits a claim. Similarly, the start of the unsecured lending process occurs when a potential borrower is identified. In both of these examples, the insured and the borrower exist outside of the business process.
Guideline #3: The business process's last function produces an output that involves a handoff from the business to another, usually external, entity or individual. In the claims process, the output is a claims payment that is sent from the insurance company to the insured or the insureds beneficiary. In the lending process, the output is a loan proceeds payment that is sent from the bank to the borrower.
Guideline #4: Processes transcend departmental lines and typically incorporate several departments, whereas a function is typically performed in one department. If you think you have identified a process and realize that it is completely performed within a department, think again. You have just successfully identified a function.
14 Steps for Analyzing Processes
Once you have distinguished the organization's processes from its functions, process analysis begins with a review of a process diagram, flowchart or systems dataflow. This diagram is one that you may have created, or someone involved in performing the process may have created it. The diagram may have been created using Visio, PowerPoint or some specialized software.
Based on experience, I know that most organizations have diagrams that depict how data or transactions flow within a function. Few organizations have diagrams that depict the cross-functional data or transaction flow within a process. For this very reason, process maps or diagrams are very popular with senior management because they provide a novel and important perspective on how the work is performed from start to finish.
Given audit's role within an organization, auditors are in a unique position to create the cross-functional process maps and furnish this valuable information to senior management, especially if the auditors use a risk-based process auditing methodology. I stress the use of risk-based process auditing because this methodology compels the auditor to commit to viewing the entity under review as a process. Since auditors have to collect data concerning the process under review in order to complete their audit planning, the development of a process map requires minimal additional effort. Process maps can actually enhance the usefulness of information typically recorded in narrative form because they succinctly depict the flow of data or transactions.
Assuming that a process map exists, the following steps will enable you to systematically evaluate the process and draw conclusions concerning its effectiveness.
Step #1: Verify the accuracy of the process map's information by meeting with representatives from all of the departments involved in the process. Make sure there is agreement concerning the process's start, end, points of interdependency, key performance indicators and systems.
Step #2: Identify gaps in the process, i.e., segments of the process in which the functions are unknown or missing. If the gap is real and not the result of overlooking some information, this is a process improvement opportunity and may also be an audit issue or concern.
Step #3: Compare the process flow to existing policies, regulations and procedures to ensure that these conditions are met satisfactorily. Pay particular attention to stipulated processing timeframes and whether the process performers have interpreted these timeframes correctly. For example, there is a big difference between same day processing and 24-hour processing, particularly when the process is not performed 7 days a week and the weekend arrives.
Step #4: Identify areas that could be streamlined, eliminated or consolidated. Opportunities for streamlining usually have the following characteristics:
- There are problem areas or unexplained gaps in the process flow.
- There are redundant steps without any value added.
- There are unnecessary steps.
- There are excessive manual steps.
There are exception-processing (non-standard) work steps (i.e., manual work-arounds which may indicate the system is not capable of performing an important task or the associate is not familiar with the system). Sometimes exception processing is warranted to address particular customer needs. If this is the case, be sure that the customer pricing covers the cost of the exception processing.
There are unnecessarily complex steps or many review points. This usually is a symptom of excessive, outdated or broken controls.
Step #5: Ask yourself if detective controls can be replaced by preventive controls, preferably ones that are systems-based. When recommending automation, try to estimate the cost and time required, and consider the amount of pending systems development work. This will help you cost-justify your recommendation.
Step #6: Identify and evaluate the adequacy of management information reporting and staff deployment in view of the process's transaction volume. Sometimes efficiencies can be gained by migrating from a centralized organizational structure to a decentralized or team-based one, or vice versa.
Step #7: Examine the critical processing timeframes and cut-offs associated with Input Processing, Output Processing, Critical Decision Points, Pending or Suspended Items(transactions) and Exception Processing.
Make sure that the process is designed to satisfy these conditions and identify the risks in these areas. A key question to ask at this juncture is: Are there controls in place to ensure the entire population is properly captured?
Step #8: Consider the risks associated with information and communication methods used in the process under review. Key questions to ask are:
Is the communication and information timely?
Is it accurate?
Is it effective among geographically dispersed locations?
Is it easy to use and understand?
Step #9: Follow the dollars. Understand how the process makes or spends money.
Step #10: Understand the fundamental purpose of the process:
Is it maximization, e.g., the sales process, where we want to make as much as possible?
Is it minimization, e.g., exceptions or errors in a production process should be low or zero.
Is it to stay at or below a floor limit, e.g., while staffing should be low, it cannot be zero.
Step #11: Categorize the process or function as revenue generating, support, control or monitoring.
Step #12: Remember what gets measured, gets done. Determine whether the incentive program and organizational structure fuel or hinder the business goals.
Step #13: When doing site-to-site comparisons, if there is a difference in how a process is handled, first determine whether the difference is artistic, i.e., how the process map is drawn. If this is not the case, then determine whether the difference is attributable to differences in perception, i.e., one diagram is high level and the other is more detailed. Finally, if the difference still persists, challenge why the same process is handled differently in two different sites. Remember to get to the root cause of the difference by asking why three to five times.
Step #14: As trite as it sounds, remember to ask:
What are they doing?
Why are they doing it?
Does it make sense?
By using these simple process analysis techniques during your next audit, you should be able to identify opportunities for process improvement and add value with ease.
Before You Begin Process Analysis, Ask These 10 Key Questions
Before you can analyze a process, you have to understand it. Ann M. Butera, a veteran consultant in the area of organizational development, recommends that you ask the following questions to acquire a broad-based understanding of the process and its functions. Once you have this broad-based understanding, you can begin your process analysis.
1. In general terms, what is the process's purpose and objectives? How congruent are the purpose and objectives in the context of the overall business goals and priorities?
2. What is the flow of money: is it revenue or expense? If the money flow is inbound to the company, who's paying us, how often, how much and for what? If the flow of money is outbound, what are we paying for, how often, and how much?
3. What key functions, preferably in sequential order, are performed as part of the process? What function starts the process? What function ends the process?
4. What departments are involved in performing the functions needed to achieve the business objectives? Who is accountable for the entire process? Who has responsibility for each of the processs functions?
5. What percentage of revenue (or expense, specific transaction type, profit, etc.) does the process generate? Is this an increasing or decreasing percentage compared to prior years and future plans?
6. What standards are used to evaluate the processs performance? Are these standards defined by a regulatory body or by the company? Are the standards measurable? How has the process fared against these standards?
7. What are the major systems used in the process? How new or old are these systems?
8. In how many geographic sites are functions of the process performed? How new or well established are these sites?
9. How many transactions does the process affect? What is the dollar value of these transactions?
10. What are the critical processing deadlines or turnaround times? Does the company or a regulatory body impose these deadlines?
|
|