Editor’s Note: This is part three of a six-part series we are doing on the Internal Audit Value Chain, which can act as a blueprint for building a successful internal audit function. Click here for the other articles in the series.
There are few efforts company leaders love more than a little old-fashioned belt tightening.
Well-run companies are on a constant campaign to trim the fat, cut out the dead wood, streamline operations, and get things humming along at a smoother pace. The textbook version of this concept is called “achieving operational efficiencies,” and like most initiatives worth pursuing, there is a big role for internal audit to play in helping the organization achieve a leaner, meaner, and better version of itself.
In fact, what corporate function is more equipped to weed out operational inefficiency than internal audit? Internal auditors have the skills to expertly assess processes, the knowledge of the business to understand how things fit together, the distance to evaluate problems with an open mind, and the discipline to make recommendations in a thoughtful, organized way. Here’s another benefit that internal audit brings to the efficiency table: Trimming the fat can occasionally cut into bone, removing layers of needed redundancy or oversight; but internal auditors, with their expertise in controls and risk management, are better equipped than most to ensure that the pursuit of operational efficiency doesn’t leave a company exposed to potential fraud and abuse, or too thin to take advantage of opportunity.
A key function of internal audit is to foster improved organizational processes and operations. Reviews are performed by internal auditors in line with the applicable Institute of Internal Auditors (IIA) standards to evaluate the effectiveness and efficiency of operations and programs. There is no other independent and qualified function within an organization to provide an objective opinion of an efficient or inefficient operation and promote continuous improvement than internal audit. This is part of the “new normal.” The push to do more with less is driven by expectations from customers for increased product and service quality and reliability and at competitive rates and reduced costs. Internal audit teams simply must do their part to achieve these goals.
The Internal Audit Value Chain
It’s been well established that internal audit must seek to add value if it is to prove its worth in the organization. In the first article in this series, “Many Internal Audit Failures Stem from Misalignment with the Company Strategy,” I defined the Internal Audit Value Chain (IAVC) and its key components. The IAVC includes “enterprise-wide initiatives impacting functional areas across every organization, involving a combination of people, processes, technology, and ‘tone at the top’ to drive the accomplishment of goals and improve profitability.” Internal audit’s role in the value chain requires understanding the organization’s: (1) strategic direction, (2) risk management and monitoring, (3) operational efficiencies, (4) quality and compliance, (5) financial reporting, and (6) responsiveness to customer and regulatory needs to create value. This installment, part three, addresses, as you have now guessed, operational efficiencies as a critical means for internal audit to create and sustain value by helping management implement efficient processes. They do this by standardizing certain tasks, reducing complexity, avoiding unnecessary duplication of efforts, and defining business requirements to select and implement the right technologies.
Indeed, technology is a frequently used tool to drive operational efficiencies. Process automation software and other applications, for example, are often used by big and small businesses globally. These products facilitate business communications, management of projects, and various initiatives in an effective and efficient manner. Yet automation is not always a silver bullet for increasing efficiency. I often consider this quote by Bill Gates when discussing operational efficiencies with clients: “The first rule of any technology used in business is that automation applied to an efficient operation will magnify the efficiency.” The best part of the quote follows: “The second is that automation applied to an inefficient operation will magnify the inefficiency.”
Internal audit plays a critical role across all line-of-business (LOB) functions to help management magnify the impact of efficient operations—those that help the company meet customer’s needs, reduce costs, and increase profitability—and minimize impact of inefficient operations—those that are poorly designed, needlessly increase complexity, hinder decision making, and obscure performance. Such inefficient operations can be compounded by inept use of technology, resulting in fraud, waste, and abuse.
In the article, “Optimizing Internal Audit” from the IIA’s Internal Auditor publication, I highlighted that internal auditors, armed with knowledge about the organization’s strategic direction and overall risks, have the capability to apply basic operational audit principles to drive results. Recommendations for cost-effective and sustainable solutions that reflect the context of the industry and issues unique to the organization (customer needs and mission-critical activities) should be foremost areas to drive operational efficiencies. Internal auditors should continuously perform reviews to determine required training and skills across functional areas and assess use of optimal processes and technologies across the organization to achieve and sustain operational efficiencies.
Eight Steps to Drive Operational Efficiencies
There are eight primary steps internal audit teams can apply throughout an organization in collaboration with other stakeholders to create and sustain value though operational efficiencies. They include:
1) Address customer needs and expectations
Finding and retaining customers is the lifeblood of any organization. Internal audit reviews to evaluate the effectiveness and efficiency of operations and programs should begin with how the organization meets and exceeds customers’ needs and expectations in an effective and efficient manner.
This includes, but is not limited to, the following operational activities: product and service quality and reliability, including quality controls; product and service mix and pricing; responsiveness to customer complaints, product recalls, and service interruptions; protecting customer information and data; and adapting to changing customers’ needs and expectations. These are examples of mission-critical activities with significant risks and costs to the organization if not managed properly and should be at the top of the list of internal audit priorities.
On one of these fronts, protecting customer data, the stakes have been raised recently. With the European Union’s General Data Protection Regulation (GDPR), which was designed to harmonize data privacy laws across Europe and reshape the way organizations approach data privacy, taking effect earlier this year, many internal audit teams are reevaluating how their organizations collect, store, and use customer data.
2) Evaluate and improve human capital requirements
If keeping customers happy is the top priority, then finding and retaining qualified employees is critical to achieving that goal. How an organization recruits, selects, and retains employees is central to the success of its operations and its ability to create value with limited resources.
An understanding of the enterprise-wide hiring and retention processes in the context of organizational goals and strategies is important for internal auditors to evaluate operational effectiveness. This includes assessments to determine if current tasks can be performed better, faster, and cheaper without compromising customer and public expectations, quality, and regulatory requirements. Such reviews provide internal audit with visibility to staff and management skills (including strengths, weaknesses, and gaps) throughout the organization.
Internal audit independence should never be compromised by performing core management activities. Internal audit can, however, leverage enterprise-wide knowledge to provide management with recommendations to improve resource strategy by evaluating critical skill requirements of the organization, how it finds qualified employees and managers to fill needs, and how to get the highest-quality work by providing the right incentives, work environment, and tools with the goal of meeting the organization’s objectives. Investment in a skilled work force that can function within the dynamic nature of the organization’s operations is critical.
3) Continuously identify and mitigate evolving risks
There are three core risks that can impact operations: (a) risks to customers, (b) risks to employees and stakeholders and (c) risks to organizational continuity. It is important to note potential conflicts that can arise when mitigating some of these risks. For example, if a bank identifies unusually large transactions from a customer’s account, management can decide to block such activities until the customer confirms transactions are valid. If the transactions are valid, such actions present an inconvenience to the customer. However, if the bank does not block such transactions and evidence confirms the customer’s account has been compromised, then the bank could be liable to any loses from unauthorized transactions.
Besides identifying and mitigating risks, internal audit must understand the evolving regulatory landscape that could impact operations and provide guidance for management to implement adequate compliance steps to prevent the following: (a) regulatory violations that could result in fines, (b) enforcement disruptions, (c) reputational damage, and (d) class action lawsuits.
4) Provide a platform to execute consistently and deliver sustained profitability
Designing and implementing efficient processes, systems, and tools is a challenge for many organizations. Training employees and documenting policies and procedures to guide consistent execution is another challenge. Internal audit can help functional managers re-engineer critical business processes to eliminate fraud, waste, and abuse and deliver profitability to shareholders.
Examples of such initiatives include those that focus on: improving inventory management, reducing cycle times, increasing speed and accuracy of transaction processing, and minimizing human intervention by automating efficient operations. They also include asset management reviews, information technology assessments, and reviews to reduce product defects and improve quality controls. Such activities have the benefits of reducing customer complaints, improving productivity, reducing cost, and increasing profitability.
5) Achieve and sustain market dominance
Internal audit should play a vital role in helping management address customer needs and expectations, engage employees in a productive manner, manage risks, address shareholder requests, and improve profitability. For government agencies, internal audit should play a role to assist management with the stewardship and accountability of taxpayer resources. These activities lead to market dominance and increased profitability for private-sector organizations and increased public perception for government agencies. Sustaining a dominant presence in the market place or providing better and more services for government agencies is even more challenging. Internal audit can help the organization maintain market dominance by fostering an environment of continuous innovation.
I must stress internal audit independence should never be compromised by performing management tasks. Internal audit can, however, assist management in achieving market dominance through operational efficiencies without compromising its independence.
6) Challenge the status quo and continuously innovate
Achieving operational efficiencies throughout an organization is not a static goal. Many organizations have achieved operational efficiencies that resulted in market dominance and significant profits over the short term, but eventually failed over time. That is because they became unsuccessful at innovating after an initial success. Internal audit interacts frequently with stakeholders throughout the organization and has the expertise to help management challenge the status quo through innovation and achieve sustainable growth critical to the long-term survival of the organization.
According to the PwC 2018 State of the Internal Audit Profession Study: Moving at the Speed of Innovation, internal auditors can serve in this valuable capacity only if they themselves are innovating. Internal audit must acquire new skills to perform operation effectiveness reviews and test controls mitigating risks related to new technology implementation and technology-driven processes. Without innovation, internal audit might fail at creating value for the organization through operational efficiencies.
7) Create a culture of operational efficiency and continuous improvement
Culture cuts across every aspect of the organization. Internal audit plays a critical role to identify and help stakeholders implement aspects of corporate culture that are conducive to continuous monitoring and achieving operational efficiencies. A corporate culture that encourages shared successes, provides the right incentives as teams continuously adapt to customer needs and expectations, and evaluates evolving risks and changing regulatory environments is critical towards achieving and sustaining operational efficiencies.
8) Continuously evaluate and monitor marketing and advertising investments
Marketing and sales operations are often overlooked by internal audit at many organizations. Marketing and advertising are critical investments for private and public sector organizations. Even government agencies can use marketing and advertising in the proper context to educate the public about their stewardship and accountability to tax payer resources. Internal audit must play a role in evaluating marketing and sales efforts; measuring the organization’s sales, marketing, and advertising performance; and provide recommendations to monitor performance and adjust the marketing and sales response.
The New Normal
While these eight steps are not the totality of internal audit’s role in helping the organization achieve and sustain operational efficiencies, they provide a solid roadmap for internal audit to collaborate with management—without compromising its independence—and create value for the organization along the way.
The reality of coping with the “new normal–doing more with less” means internal audit must do more to address the fundamental aspects of the organization, such as customer service, human resources, and marketing, rather than just focusing on the traditional, financial-based internal audit tasks. Executives and managers should empower business unit leaders and internal audit teams to continuously challenge the status quo, starting with mission critical activities to drive and sustain operational efficiencies.
Click here for the other articles in the series.
Jonathan Ngah, CISA, CIA, CFE, CGFM, is a Principal at Synergy Integration Advisors, a consulting firm providing audit and governance, risk, and compliance (GRC) solutions to federal government agencies and private-sector and not-for-profit organizations.