Internal Audit - Analyzing Business Processes

Business Process

a set of connected activities linked with each other for the purpose of achieving one or more business objectives

Business Process Objectives

- Strategic

- Operations

- Reporting

- Compliance

Strategy

How management plans to achieve the organizations objectives

Types of business processes (3)

- Operating Processes

- Management/support processes

- Projects

Operating Procesesses

Core processes where the organization creates value

Management/Support Processess

Support the value embedded in the organizations objective

Projects

Organize value creating activities when activities happen over an extended period of time

Core operating processes (2)

- Manufacturing

- Service Provider

Main types of projects (2)

- Project Operate

- Project Deliver

What are the two approaches to understanding business processes?

- Top Down

- Bottom Down

Top Down Approach

- Start at entity level with organizations objectives

- Identify key processes critical to success

- Match the key procesess to achieving the objective

Bottom Up Approach

- Start with the processes at the activity level

- Then aggregate across the organization

- Works well for smaller organizations

Step 1 of the top down approach

Determine the key objectives of a process

Step 2 of the top down approach

Understand process inputs/outputs

Step 3 of the top down approach

Understand KPIs of a process

What must KPIs be to be effective

Specific and measurable

Why are KPIs important?

- They provide information, transparency, and understanding

- They assist in goal achievement

- They bring greater speed, accuracy, and performance

What are the types of KPIs?

- Productivity, capacity

- Efficiency, effectiveness

- Profitability, competitiveness

- Quality, value

Critical to Quality Measures

The translation of customer expectations expectations and needs into defined/quantified measures of success for a business' products and services

The Voice of the Customer (VOC)

The starting point for translating customer needs into CTQ requirements

Who must document business processes?

The process owner and the people involved in the process

What is business process documentation used for?

- Orient new personnel

- Define areas of responsibility

- Evaluate efficiency

- Determine areas of primary concern

- Identify key risks and controls

What are the two business process documentation methods?

- Process Maps

- Process narratives

Process Maps

Graphical representations of the steps within the process that use a set of defined shapes to indicate the low of the process, including its starting and ending points, steps, and decision points

Audit Universe

The activities that the internal auditing function has identified as auditable subjects, activities, units or functions

What to consider in the audit universe

Audit charter, mandatory coverage, and the organization's formal structure

What are the 5 risk responses?

- Accept

- Avoid

- Pursue

- Reduce

- Share

Accept

No reaction, accept level of risk

Avoid

Cease activities associated with risk

Pursue

Exploit risk if necessary to achieve a particular business objective

Reduce

Take action to reduce the risk. Includes establishing internal controls

Share

Transfer or sharing a portion of the risk

Business Risk Profile

Identifies the critical risk to achieving objectives

Where does the internal audit function build its risk assessment?

From the business risk profile.

In what terms are risks assessed in?

Impact and Likelihood

What must internal audit establish links between?

Risks and business processes

Key Link

Process plays a direct role in managing risk

Secondary Link

The process helps to manage the risk indirectly

What processes would be candidates for a comprehensive audit?

A process with key links to several risks

What is the first step in analyzing a business process?

The identification of trigger events

Trigger events

Events that begin or end the business process, as well as any actions moving the process forward

What should be identified when redesigning a business process?

- Cost and Time Drivers

- Bottlenecks