This is Part III – Operational Efficiencies of a revised six-part series on the internal audit value chain (IAVC).
Management should empower business unit leaders and internal audit teams to continuously challenge the status quo, starting with mission-critical activities to drive operational efficiencies.
Initial publication – September 23, 2018. Updated – May 15, 2020.
There are few efforts company leaders love more than a little old-fashioned belt-tightening. Well-run companies are on a constant campaign to trim the fat, cut out the deadwood, streamline operations, and get things humming along at a smoother pace. The textbook version of this concept is called “achieving operational efficiencies.” Like most initiatives worth pursuing, there is a significant role for internal audit to play in helping the organization achieve a leaner, meaner, and better version of itself. In fact, what corporate function is more equipped to weed out operational inefficiency than internal audit? Let me provide a few reasons.
- Internal auditors have the skills to expertly assess processes,
- The knowledge of the business functions and operations to understand how things fit together,
- The proficiency in analyzing big data, and utilizing a risk-focused approach to audit what matters,
- The distance and independence to evaluate problems with an open mind, and
- The discipline to make recommendations in a thoughtful, organized way.
Here’s another benefit that internal audit brings to the efficiency table: Trimming the fat can occasionally cut into the bone, removing layers of needed redundancy or oversight. However, internal auditors, with their expertise in controls and risk management, are better equipped than most to ensure that the pursuit of operational efficiency doesn’t leave a company exposed to potential fraud and abuse, or too thin to adapt and respond to the changing environment or take advantage of opportunities.
The unprecedented challenges from COVID-19 disrupted businesses globally across every sector as of February 2020. Some organizations have responded to the difficulties relatively well, while others continue to struggle. Why? The efficient use of resources and technology provides management with the flexibility to pivot and the agility to quickly reallocate resources to respond to the pandemic efficiently. Such organizations typically have well managed Continuous Process Improvement (CPI) projects, enhanced processes, and lean operations. An essential function of internal audit is to foster improved organizational processes and operations. Reviews are performed in line with the applicable Institute of Internal Auditors (IIA) standards to evaluate the effectiveness and efficiency of operations and programs.
There is no other independent and qualified function within an organization to provide an objective opinion of an efficient or inefficient operation and promote continuous improvement than internal audit. This continues to be part of the “new normal” since the disruptions and challenges from the COVID-19 pandemic.
The push to do more with less is driven by expectations from customers for increased product and service quality and reliability and at competitive rates and reduced costs. In the long-term, customers will not care how a pandemic like COVID-19 impacts an organization. Internal audit teams simply must do their part—in helping management create value, capture value, and sustain value to achieve goals through operational efficiencies.
The Internal Audit Value Chain (IAVC)
It’s been well established that internal audit must seek to add value if it is to prove its worth in the organization. In the first article in this series, “Many Internal Audit Failures Stem from Misalignment with the Company Strategy,” I defined the IAVC and its key components. The IAVC includes “the enterprise-wide initiatives impacting business functions, involving a combination of people, processes, technology, and corporate culture to drive the achievement of strategic goals and sustain profitability.” Internal audit’s role in the value chain requires an understanding of the organization’s:
- Strategic direction and alignment
- Risk management and monitoring
- Operational efficiencies to include Continuous Process Improvement (CPI)
- Quality and compliance
- Financial management and governance
- Responsiveness to create, capture, and sustain value while adapting to the changing business environment.
It’s essential to keep in mind that these priorities are not static and vary as enterprise objectives and needs evolve. This installment, part three, addresses, as you have now guessed, operational efficiencies as a critical means for internal audit to create and sustain value by helping management implement efficient processes. They do this by
- standardizing certain tasks,
- reducing complexity,
- eliminating none-value add steps, and avoiding unnecessary duplication of efforts,
- defining business requirements, managing CPI projects, and
- selecting and implementing the right technologies.
Indeed, technology is a frequently used tool to drive operational efficiencies. Process automation software, Robotic Process Automation (RPA) initiatives, and other applications, for example, are often used by big and small businesses globally. These products facilitate business communications, management of projects, and various initiatives effectively and efficiently. Yet automation is not always a silver bullet for increasing efficiency.
I often consider this quote by Bill Gates when discussing operational efficiencies with clients: “The first rule of any technology used in a business is that automation applied to an efficient operation will magnify the efficiency.” The best part of the quote follows: “The second is that automation applied to an inefficient operation will magnify the inefficiency.”
Internal audit plays a critical role across all line-of-business (LOB) functions to help management magnify the impact of efficient operations—those that support the company meet customer’s needs, reduce costs, and increase profitability—and minimize the effects of inefficient operations—those that are poorly designed, needlessly increase complexity, hinder decision making, and obscure performance. Such inefficient operations can be compounded by inappropriate use of technology, resulting in significant cost and the inability to respond to a pandemic like COVID-19. Technological inefficiencies can result in fraud, waste, and abuse.
If internal audit is creating value by auditing what matters, then the right technology or technologies must be adopted—driven by the nature of problems we are assisting management in solving. Technologies are not selected and approved strictly from an internal audit perspective, such as the tools to plan, execute, and report on various audits and reviews. Such a selection approach means so little to the functional managers we support. The right technology should focus on the following:
- What type of information does internal audit need from the business to review and add value?
- What is the best technology to obtain, evaluate, and analyze this information?
- What output could internal audit provide from using this technology?
- How will the output help management to create value, capture value, and sustain value?
- What trends does internal audit see from analyzing data and highlight issues to facilitate meaningful conversations with management?
- How could the output from internal audit help management and internal audit gain insights to effectively resolve critical problems and perform deep dives to review what matters to management?
- What should internal audit and management do differently DURING and post-COVID-19?
Eight Steps to Drive Operational Efficiencies
In the article, “Optimizing Internal Audit” from the IIA’s Internal Auditor publication, I highlighted that internal auditors, armed with knowledge about the organization’s strategic direction and overall risks, can apply basic operational audit principles to drive results. Recommendations for cost-effective and sustainable solutions that reflect the context of the industry and issues unique to the organization (customer needs and mission-critical activities) should be foremost areas to drive operational efficiencies. Internal auditors should perform reviews to determine the required training and skills across functional areas and assess the use of optimal processes and technologies to achieve and sustain operational efficiencies.
There are eight primary steps internal audit teams can apply throughout an organization in collaboration with stakeholders to help management create, capture, and sustain value through operational efficiencies. They include:
1) PRIORITIZE CUSTOMER NEEDS AND EXPECTATIONS: Finding and retaining customers is the lifeblood of any organization. Internal audit reviews to evaluate the effectiveness and efficiency of operations and programs should begin with how the organization meets and exceeds customers’ needs and expectations effectively and efficiently. Some factors to consider include but not limited to, the following:
- What known and emerging risks could significantly impact the organization’s ability to meet and exceed customers’ expectations?
- What trends or data, and tools can internal audit use to evaluate the pace of emerging and evolving risks and how that impacts the organization from meeting changing customer expectations?
- How could the organization provide quality products or services during a disaster when operations are impacted at one location or multiple locations?
Other essential factors in evaluating the effectiveness and efficiency of operations include, but is not limited to, the following activities:
- product and service quality and reliability, including quality controls,
- product and service mix and pricing, and
- responsiveness to customer complaints, product recalls, and service interruptions,
These are examples of mission-critical activities with significant risks and costs to the organization if not managed properly and should be at the top of the list of internal audit operational review priorities.
2) EVALUATE AND IMPROVE HUMAN CAPITAL REQUIREMENTS: If keeping customers happy is the top priority, then finding and retaining qualified employees is critical to achieving that goal. How an organization recruits, selects and retains employees is central to the success of its operations and its ability to create value, capture, and sustain value with limited resources. An understanding of the enterprise-wide hiring and retention processes in the context of organizational goals and strategies is vital for internal auditors to evaluate operational effectiveness. This includes assessments to determine if current tasks can be performed better, faster, and cheaper without compromising customer and public expectations, cost, quality, and regulatory requirements.
Such reviews provide internal audit with visibility to staff and management skills (including strengths, weaknesses, and gaps) throughout the organization.
Internal audit independence should never be compromised by performing core management activities. Internal audit can, however, leverage enterprise knowledge to provide management with recommendations to improve resource strategy by evaluating critical skill requirements of the organization such as (a) how it finds qualified employees and managers to fill needs, and (b) how to get the highest-quality work by providing the right incentives, work environment, and tools to meet the organization’s objectives.
Investment in a skilled workforce that can function within the dynamic nature of the organization’s business environment and maintain lean operations is critical. Factors to consider include but not limited to, the following:
- Does the existing policies and procedures provide clarity and guidance on how staff and contractors can work-onsite and offsite?
- Have these policies and procedures been updated to guide remote work teams during COVID-19?
- What challenges emerge when staff trained to work on-site to process transactions, and retain evidence, who must now access critical data remotely, to handle the same transactions offsite and maintain evidence digitally?
- How could such a sudden transition impact current and future audits, reviews, and examinations?
3) CONTINUOUSLY IDENTIFY AND MITIGATE EVOLVING RISKS: Three core risks can impact operations:
- Risks to customers – internal and external factors that could prevent the organization from meeting customers’ needs and expectations.
- Risks to employees and stakeholders – internal and external factors that could radically change how cross-functional teams collaborate to deliver products and services within cost and quality parameters.
- Risks to organizational continuity – internal and external factors impacting operations across multiple locations, and the organizations ability to quickly adapt and respond to those challenges.
Note: Identifying, prioritizing, and mitigating risks (including emerging risks and threats, and the pace of rapidly evolving risks) belongs to the risk owner—management. In the process of adding value by helping management solve problems, they recognize as vital; internal audit can provide support without compromising its independence.
It is important to note emerging risks associated with these three categories, and how current risks evolve, and the pace at which these risks evolve. Internal audit must also understand the potential conflicts that can arise across business functions and operations when mitigating risks. Internal audit must understand the evolving regulatory landscape that could impact operations and provide guidance for management to implement adequate steps to prevent the following:
- Regulatory violations that could result in fines,
- Enforcement disruptions,
- Unplanned disruptions from natural disasters and pandemics like COVID-19,
- Reputational damage, and
- Class action lawsuits.
4) PROVIDE A PLATFORM TO EXECUTE CONSISTENTLY AND DELIVER SUSTAINED PROFITABILITY: Designing and implementing efficient processes, systems, and tools is a challenge for many organizations. Training employees and documenting policies and procedures to guide consistent execution is another challenge. Internal audit can help functional managers re-engineer critical business processes to eliminate fraud, waste, and abuse and deliver improved financial performance. Examples of such initiatives include those that focus on:
- Continuous Process Improvement (CPI),
- improving inventory management,
- reducing cycle times,
- increasing speed and accuracy of transaction processing, and
- minimizing human intervention by automating efficient operations.
They also include asset management reviews, information technology assessments, and reviews to reduce product defects and improve quality controls. Such activities have the benefits of enhancing the organization’s ability to respond to an unprecedented pandemic like COVID-19, minimize customer complaints, improve productivity, reduce cost, and increase profitability.
5) ACHIEVE AND SUSTAIN MARKET DOMINANCE: How well an organization executes its strategy impacts how quickly it can achieve and sustain market dominance. To create value, internal audit must identify and resolve strategic misalignment problems timely (IAVC Part I – Strategic Alignment). That is the first step for internal audit to create value, and continue to help management capture and sustain value by assisting with the following: respond to customer needs and expectations, productively engage employees, manage risks, address shareholder requests, and improve profitability. For government institutions, internal audit should play a role to assist management with the stewardship and accountability of taxpayer resources. Internal audit can help the organization maintain market dominance by fostering an environment of continuous innovation.
I must stress internal audit independence should never be compromised by performing management tasks. Internal audit can, however, assist management in achieving market dominance through operational efficiencies without compromising its independence.
6) CHALLENGE THE STATUS QUO AND CONTINUOUSLY INNOVATE: Achieving operational efficiencies throughout an organization is not a static goal. Many organizations have achieved operational efficiencies that resulted in market dominance and significant profits over the short term but eventually failed over time. Some profitable organizations might not recover from the COVID-19 disruptions. That is because they became unsuccessful at innovating or adapting to the changing environment after an initial success. Internal audit frequently interacts with stakeholders throughout the organization. It has the expertise to help management challenge the status quo through Continuous Process Improvement (CPI), and adapt by fostering innovation and achieving sustainable growth critical to the long-term survival of the organization.
According to the PwC 2018 State of the Internal Audit Profession Study: Moving at the Speed of Innovation, internal auditors can serve in this valuable capacity only if they themselves are innovating. Internal audit must acquire new skills to perform operational effectiveness reviews and test controls mitigating risks related to new technology implementation and technology-driven processes.
Without innovation, internal audit might fail at creating value for the organization, and unable to help management capture and sustain value through operational efficiencies.
7) CREATE A CULTURE OF EFFICIENCY AND CONTINUOUS IMPROVEMENT: Culture cuts across every aspect of the organization. Internal audit plays a critical role to identify and help stakeholders implement aspects of corporate culture that are conducive to continuous monitoring, provide guidance to develop a culture of problem solvers, and achieve operational efficiencies. A corporate culture that encourages shared successes provides the right incentives as teams continuously adapt to customer needs and expectations. It speeds the process to evaluate evolving risks and changing regulatory environments—critical steps towards achieving and sustaining operational efficiencies.
8) MONITOR PROGRESS: Using the right Key Performance Indicators (KPIs) and Metrics and close attention to the Key Risk Indicators (KRIs) are vital tools for management and internal audit to evaluate progress. Data collected and analyzed over time, provide early alerts to areas impacting strategic goals. Internal audit can use this data (KPIs, Metrics, and KRIs) to perform deep dives (plan and execute audits and reviews that matter) to understand the root causes of operational inefficiencies, and provide recommendations for management to monitor performance and make timely adjustments.
The New Normal
While these eight steps are not the totality of internal audit’s role in helping the organization achieve and sustain operational efficiencies, they provide a reliable roadmap for internal audit to collaborate with management—without compromising its independence—and create value, capture and sustain value for the organization along the way.
The reality of coping with the “new normal–doing more with less” existed pre-COVID-19 and will remain the same post-COVID-19. That means internal audit must do more to help management without compromising its independence address the fundamental features of the organization, such as customer service, human capital, strategy alignment, risk management, and periodically review the effectiveness of Continuous Process Improvement (CPI) initiatives. These are value-added steps rather than just focusing on the traditional, financial-based internal audit tasks. Executives and managers should empower business unit leaders and internal audit teams to continuously challenge the status quo, starting with mission-critical activities to drive and sustain operational efficiencies.
Jonathan Ngah, CISA, CIA, CFE, CGFM, is a principal at Synergy Integration Advisors, a professional services firm providing internal audit outsourcing and internal audit co-sourcing services to government institutions, private-sector, and not-for-profit organizations in the US and the Asia Pacific (APAC) regions.