Audit Universe
Audit Universe
ng/internal_audit/audit_process/audit_universe/
https://reciprocity.com/resources/what-is-an-audit-
universe/#:~:text=An%20audit%20universe%20improves%20transparency,%2C%20co
ntrols%2C%20and%20business%20strategies.
An audit universe is a document that details all the audit activities to be carried out by
the internal audit function.
It consists of multiple and distinct auditable entities, processes, and activities, which
can be considered “auditable units.” The number of these auditable units varies
depending on the organization’s size, business complexity, and operational scale. In
some cases they can run into the hundreds or even thousands.
There are multiple ways to create auditable entities. One is to construct them as per
the key risks or controls. Another is by product or service lines, business units,
functional teams, business processes or systems, legal entities, or regulatory audits
required.
The audit universe is a “living document” and should be updated regularly based on
business needs, risk exposure, and other relevant risk factors.
Do I Need to Establish an Audit Universe?
Size
Geographical reach
Industry
Activity types
The CAE may also consider creating an audit universe based on the assurance
requirements of the company’s board, audit committee, or other relevant stakeholders.
An audit universe has proven to be beneficial for many organizations. One reason is
that it can inform an organization’s risk management practices and strategic internal
audit plan. Creating an audit universe can help with mapping the various risks, internal
controls, and regulations to each business unit. There’s also the added benefit to
reviewing audit history.
For each internal audit activity, an audit universe clarifies and documents the extent of
coverage of key risks by internal auditing. This information can help the risk
management and compliance teams during resourcing discussions, hiring, and
allocations. It also helps to establish which group (or “line of defense”) provides
assurance in which area.
An audit universe improves transparency to the internal audit function. It provides audit
committees and other stakeholders with a greater cyclical awareness of audit
management.
It also enhances the audit committee’s knowledge about the organization’s specific
risks, controls, and business strategies. By increasing the committee’s understanding
of the different functions and departments, the committee can better identify control
gaps, form overall audit opinions, and create a consolidated, enterprise-wide
assurance map.
This ability to perform risk-based auditing (see next section) is invaluable for
organizations since the internal audit function can’t perform all possible audit activities
due to limited resources. Instead, the audit team can determine and update the audit
universe based on the criticality of the risks that should be addressed on priority.
Too few auditable units can lead to a loss of granularity because the groupings are too
broad. On the other hand, too many auditable units may result in too much time spent
(or wasted) completing internal audits and risk assessments for each entity.
It can be helpful to refer to the organization chart, risk registers, or accounting cost
centers to reconcile the auditable entities within the audit universe and assure its
completeness.
Overview Section
For maximum usefulness, the audit universe should include an Overview section. This
section should consist of a list of all the audits per auditable entity or business area.
Risk Register
The audit universe should include the “risk register” (that is, a formal catalog of risks)
directly aligned with individual audit topics or business processes. This mapping helps
with the creation of a risk-based audit plan that, in turn, can help with the proper
allocation of all audit activities and resources to the most high-risk areas.
The mapping can also reveal how risk-averse the organization is and whether its
existing risk thresholds are appropriate.
Previous Audits
Mapping previous audits against the audit activities identified in the Overview section
can help the organization:
Identify what actions (if any) have been performed against high-risk areas
Additional Elements
Internal components
Strategic plan and goals
Business model
Internal reviews: First and second lines of defense (operating units in the First Line;
compliance and risk management teams in the Second Line)
External components
External reviews
Industry trends
Robust auditing and risk management start with better risk visibility. ZenGRC shows
these risks and where they’re changing in your organization, so you can better manage
risks and mitigate business exposure.
You can operationalize risk management, calculate risks, and remediate them with
real-time updates from one application. A visual dashboard creates a clear view for
monitoring performance, while reporting and insights reveal more details about your
risk posture.
https://zipreporting.com/en/business-process-management/stages-of-business-
process-management.html
n the era of digital transformation, organizations collect large quantities of data each
day. This valuable information paints a story about the supply chain and the
performance of internal business processes. It's critical to tweak and improve business
activities to maintain a competitive edge as external conditions change. Both small and
large-size organizations employ business process management to make sure each
current process aligns with new company goals.
Methodologies - The organization should manage all BPM solution methods and
techniques that help to optimize task management. For example, many companies
employ the Six Sigma method in conjunction with BPM to optimize business
processes.
Information Systems - The success of any BPM strategy relies on how functional the
internal IT solutions are. An organization should ensure all information systems and
databases can integrate and work with process automation software.
People - All people involved with process management software need to know how to
operate the software and leverage it to align with company goals. The organization
should train all employees on the software and explain exactly why it is used.
Culture - Any business that invests in a management system needs to align its values
and culture with BPM initiatives. Technology cannot function without a company culture
that embraces it.
Measurement of performance
Define and List Each Existing Processes - Leaders should drill down into current
processes and list all of them before they embark on a BPM strategy.
The organization should categorize existing processes depending on whether they are
primary, secondary, or management. Primary processes are the essential
requirements that generate a product or service. Everyone should be able to easily
identify these.
Secondary processes offer support to the primary activities. While secondary activities
do not provide value to customers, they are essential to maintain operations. Human
resources, securing supplies, or managing information systems are all secondary
processes.
Finally, management processes include any activities that management handles. For
example, a manager/owner supervises the BPM strategy from start to finish. The
company should also identify any metrics and KPIs it plans to use to measure the
performance of a BPM initiative.
The BPM manager should determine whether existing business activities align with
company goals during this phase of the life cycle. Most companies collect all relevant
data on each of these activities. They gather information from current company
records, databases, or process models. It's also critical to drill down into every metric
used to assess performance to determine whether it is effective.
Organizations also use quantitative or statistical analysis to drill down into data. They
may use flow to assess capacity requirements, queuing to analyze variability in delays
and rework, and process simulation to review processes that run simultaneously.
Organizations employ various types of analyses depending on the size and scope of
the company. The main purpose of this stage is to determine whether processes align
with the company objectives or not.
Modeling documentation is also a part of this phase. This requires individuals to outline
the time and duration of each activity, where it occurs, and who is involved. It's also
helpful to include any technologies or sequences within the process, as well as any
external factors that impact it.
Diagrams, summaries, or workflow charts are effective ways to document and analyze
all internal workflows. Managers may continuously improve processes and find
solutions for new problems, or redo the entire structure from start to finish.
Review requirements and details to design a process that delivers those requirements
Now, BPM managers are ready to implement the new, revamped processes.
Implementation can either be systemic or non-systemic. Systemic implementation
requires an organization to employ BPM software or other systems.
The non-systemic implementation does not involve technologies, but it may require a
change in personnel or an adjustment in the activity sequence. A business can choose
either implementation strategy, depending on its type of activities and the number of
resources at its disposal.
Of course, the organization should always check to see if the performance aligns with
its own goals and requirements. Most companies invest in dashboards or other
business intelligence solutions to easily monitor process performance and generate
reports.
Businesses can innovate and optimize processes if managers regularly monitor and
tweak current activities. This phase exists to employ various strategies in conjunction
with business process management software to optimize process management, and
achieve operational effectiveness.
Look at the big picture and determine which steps are required to deliver a product to
consumers and offer good customer service
Understand where a process starts and finishes. First, identify where the product starts
and ends
Use business associates and team members' expertise to ask for feedback
Look at historical data to pinpoint any inefficiencies or areas for process improvement
In conclusion, here are the key takeaways to remember about business process
management
The first stage of the business process management life cycle is planning and
strategizing. Next, managers need to analyze current business processes to determine
which areas need improvement.
The third stage of the life cycle is to implement process modeling to improve existing
activities. This requires diagramming techniques. In stage four, the organization is
ready to implement the process.
A manager needs to review and manage each process with BPM tools to make
continuous improvements in stage 5. In stage 6, the organization grows and innovates
as it refines and improves each activity. As external conditions change, so should the
business activity.
http://www.vits.org/publikationer/dokument/81.pdf
https://er.educause.edu/articles/2016/5/10-common-process-improvement-mistakes-
and-how-to-avoid-them
Key Takeaways
Tips and lessons learned from a process improvement team's experience and
observations made while facilitating or mentoring other groups address some of these
problems.
Understanding the process from beginning to end is the best way to ensure that
you make the right decisions, and becoming aware of some common
challenges should help you avoid them.
After a few weeks of working with the department, we helped them develop a holistic
end-to-end process that significantly improved their service delivery while reducing the
administrative cost to them and their customers. We found areas where inconsistent
practices were causing inefficiency and developed solutions to bring them into
alignment. In another example, we discovered where adherence to an outdated policy
significantly slowed the process. We also uncovered several areas where the unit
incurred additional costs to support processes that had no apparent value. With their
methods purposely redesigned, the department was able to implement a technology
solution to facilitate their process rather than experience the previous pain and high
cost.
We have all seen it happen: An organization buys a shiny new piece of technology and
then tries to implement it without first having looked hard at its own processes and
people. The result? The vast majority of the time, the project doesn't live up to
expectations — it exceeds the budget, takes longer to plan than to finish, or fails to
meet the original goals. Even when "successful," too many times the new technology
looks a lot like the prior technology in terms of how it works. People start saying to
each other, "Why did we go through all this? This doesn't work nearly as well as the old
system." This situation occurs because the organization embarked on a technology
project without first looking at, and improving, the underlying processes.
For those new to process analysis and improvement efforts, they can seem daunting,
often with little guidance available as to what to do and not do. Even those steeped in
process improvement can find themselves making common mistakes. As a result,
many process improvement efforts fail to achieve their intended goals or even make it
to the finish line. Worse, some end up being counterproductive and a waste of
organizational resources.
My purpose here is to address some of these problems by providing tips and lessons
learned from my team's experience as well as observations made while facilitating or
mentoring other process improvement groups. My team is itself deeply indebted to the
mentoring and teachings of Alec Sharp.1
Suggested Practice: When starting a new process improvement project, you must set
the stage for the work ahead. Be sure to discuss the overall process (or process
landscape) and understand the related processes which come before and after, and
those that interact with it. This activity will help define the scope of your work and put
each process in context with neighboring processes. In addition, make sure it is clear
how the process furthers the organization's objectives. Do not dismiss previous work
you might be handed, but at the same time do not let those dissuade you from having
the conversations to develop the context.
A common error both novices and experts make when conducting process
improvement is to focus too heavily on the artifacts (diagrams, flowcharts, and other
physical deliverables) without enough attention to the processes and conversations
that build those artifacts. While these tools have some value on their own, much of
their value is derived from the interactions and discussions behind them. If the artifacts
held the value, you could simply borrow flowcharts from a similar organization and
implement them. However, this approach rarely works well. It is easy to fall into the trap
of gathering a few people (or worse yet, doing it solo) to sketch out some swim-lane
diagrams and scenario lists and then feel the process work is complete. These efforts
often end without the necessary context and commitment to develop effective
recommendations. Similarly, it is ill advised to rely on the vendor to provide concept
models, workflows, etc. The perspective of an external entity is not a substitute for
conducting a rigorous process improvement effort.
Suggested Practice: One theme rooted in process analysis and improvement is the
social nature of the endeavor, and a deeper understanding and likelihood of adoption
arises through conversation and questioning. The focus of initial conversations should
be around understanding the business process and related challenges. Existing
artifacts can be useful for providing background information, but do not use them as
substitutes for developing your own. Do not create your interview questions based on
the documentation you plan to create, and always be open to conversations taking a
path you might not have considered. The artifact creation should come later in the
process or can be done as a group activity, which might facilitate conversations around
the details and challenges related to the process.
Sometimes groups find themselves well into a process improvement effort when
rumblings start questioning the effort's rationale and purpose. Stakeholders may be
confused as to the objectives, begin questioning previous decisions, or ask if the effort
is even a good idea. Sometimes the answers to these questions are vague, but more
often the ideas themselves are not clear, objectively defined, or universally agreed
upon. This can lead to poor process analysis and weak recommendations when there
is a lack of consensus as to the real objective.
Suggested Practice: Three questions must be clearly answered to make the case for
action.
First, "What problem are we trying to address?" This question frames the effort of
making sure there is agreement on the root issue. For instance, the initial problem
might be identified as an IT system not working properly, while the
appropriate process problem is the much greater issue with the end-to-end process
within which the IT system was recently added.
Second, "Why is this a problem we should focus on?" This question requires a sense
of urgency to find a solution and a shared vision of future problems if the problem
persists.
Finally, "What are our objectives in improving this process?" Answering this question
will get agreement on the effort's objectives (e.g. are we trying to reduce cost, provide
better service, and so forth) as well as describe an idealized state.
At the initial project kickoff meeting, make sure of agreement and understanding
around the answers to these questions as to the goals and objectives of the process.
Ideally this will produce a single guiding principle, but it is possible to have two or three
objectives. These objectives must include clear statements of what and why, but not
dictate how or who (e.g. we need information to be available to multiple departments
rather than that finance and human resources need a shared solution). This will help
when determining where in the process to focus and what innovations and
recommendations will align with those objectives. These conversations help build
alignment around a case for action.
Suggested Practice: Some people may be overlooked for many reasons when
identifying your interview list. Sometimes no one knows about everyone involved;
individuals can be difficult to identify because of confusion with the sub-process;
sometimes political or interpersonal reasons interfere. Always err on the side of
inclusion. The best ideas or insights can come from the individual everyone else tells
you not to include. You might hear that they are difficult to work with or disagreeable.
One of the process improvement team's roles is to uncover and bridge these
organizational gaps. Many times you will be the glue that brings these disparate
organizations together, and your facilitated sessions might be one of the few
opportunities for them to share knowledge and process pains with one another.
A good framework for inclusion is to identify and include these six groups of people:
actors (anyone who performs the work), customers, owners, partners, suppliers, and
administrators of IT systems. The project sponsor often can provide a good initial list,
but as you work through your interviews, make sure you listen closely and ask for
additional individuals to talk to who are part of the process. Frequently the final number
of interviewees will be two to three times the initial number.
Before diving into a process and asking questions about specific activities, set the tone
of the conversation by identifying the goals of each individual involved in the process.
Initially, it is important to spend a fair amount of time identifying who the users and
actors are in the process and what they are trying to accomplish. Understanding this at
a macro level (what are they trying to accomplish overall) and at the process level
(what are they trying to accomplish with this particular process) helps set the stage for
the analysis. It also ensures guided solutions according to "what people are trying to
do" and not strictly by "how can we make what they are currently doing better?" The
former can lead to innovation and efficiency improvements, while the latter restricts the
analysis to efficiency.
Suggested Practice: Prior to the project kickoff, gather information through research
or informal conversations to understand the process's actors and goals. This will give
you a general understanding of the process and players so that you can dig a little
deeper during the kickoff meeting. For example, you might discover that instead of
fulfilling an administrative function (e.g. hire an employee), someone is actually trying
to do something more mission-driven (e.g. hire elite staff who will improve their level of
quality). Additionally, during one-on-one interviews, take the opportunity to ask probing
questions to get to the details from various perspectives. Ask about changes in their
role, changes in their industry, what challenges and frustrations they have, and so
forth. Experience has shown that most individuals are receptive to such questions and
appreciate your interest in understanding their world.
Many problems in process work come down to language used and how different actors
perceive the existing process. Those coming into a new process often assume that
there exists a common definition of the language of the process. Usually we have
found that this is not the case. Each group — even individuals within a group — has a
different way of describing the process. Even general concepts such as "student" or
"purchase order" may be used quite differently by different groups. This often leads to
confusion and makes improvement more difficult.
Suggested Practice: Defining terminology, roles, and relationships will help both you
and the clients develop a clear understanding of common terms (e.g. what is a student)
as well as permutations of that term (e.g. full-time, part-time, on-campus, honors,
ROTC, international). You need to establish a common vocabulary that all
stakeholders can understand, reducing confusion. Creating a dictionary that ensures
terminology alignment can serve as a basis for a data model developed later as part of
a technology solution. Many of these terms might seem obvious, but forcing the shared
conversation will help clear up misconceptions you or various actors have. Remember,
you will be working with a broad set of users with different backgrounds. Do not be
afraid to ask for clarification and confirm definitions of key terms and functions.
Most people who engage in process work are problem solvers by nature. As a result,
when encountering a problem, their first instinct is to immediately solve it. Many
process specialists will start mentally designing a solution after speaking with a
stakeholder, sometimes even during the interview. Trying to solve the problem instead
of listening can close you off to new information and data that could be critical to
understanding both the existing process and what is needed to improve it. It also
creates blinders to possibilities raised in subsequent interviews; the analyst might even
skip them. In addition, preconceived ideas or thoughts from earlier interviews could
overly influence the recommendations, which might not lead to the best results.
Overall, remember that it is difficult to listen effectively when your mind is in problem-
solving mode.
Suggested Practice: When having conversations, focus on listening. While you are
likely to see obvious improvements early on, do not start solving or leading your
interview to the solution you created. If participants begin to suggest ideas for
improvement, document their ideas. Also focus on understanding the current process.
Assuring others that their visions will be captured and considered is often enough to
allow them to refocus on the current exercise. One tool that might help is to start a
project "idea incubator" or "holding area" for these ideas and remind participants that
you can only get to those discussions after you have a better understanding of the
existing process.
Process flow
Policies
Talent alignment
Facilities
Overly focusing on technology shuts out many of these other opportunities. We have
found that IT recommendations are usually only about 30 percent of the total, with
valuable improvements identified in all of the enablers.
Suggested Practice: Resist the temptation to see new technology as a way of solving
problems in the process. Explore the other five enablers one at a time before
considering IT systems and tools. Doing so will help uncover other often cheaper and
easier to implement solutions as well as improve organizational process. The
investment of time and effort in improving the process before the technology
implementation will pay off many times over in simplifying the technology application
and lowering the total cost of ownership.
Most processes are far more intricate, with many more steps, than will be described by
most interviewees. When dealing with activities people do repetitiously without much
thought, it is easy to miss details. Opportunities for improvement can be overlooked
when actors and stakeholders remain undefined. Essential stakeholders and actors
probably would not receive recognition for their involvement if not included in previous
discussions.
Suggested Practice: Write down the details of the process. Any verb or noun hints at
an activity taking place. While it might be tempting to gloss over seemingly minor items
(e.g. the admin who stuffs the paper into the envelope), do not skip anything. Describe
the process and actors with as much fidelity as possible. It might benefit you to have
someone unfamiliar with the process there to ask additional probing questions and
help validate completeness.
Suggested Practice: Three suggested practices can help overcome this challenge.
First, setting a clear purpose and engaging a broad set of stakeholders will increase
the opportunity for buy-in and alignment of purpose.
Second, have regular check-ins with the project's stakeholders to keep them abreast of
progress, get their feedback, and make sure you learn of changes in the political and
strategic environment.
Third, design the recommendations delivery briefing to be the start of the transition
phase, not the end of the process phase.
By the end of the analysis, the staff doing the process work has gained significant
expertise and can facilitate the transition to solutions development. This can ensure the
recommendations are not the end of the effort, but rather a key midpoint in the
solutions development.
https://checkify.com/blog/business-process-improvement/
https://www.cliffsnotes.com/study-guides/principles-of-management/creating-
organizational-structure/the-organizational-process
Organizing, like planning, must be a carefully worked out and applied process. This
process involves determining what work is needed to accomplish the goal, assigning
those tasks to individuals, and arranging those individuals in a decision‐making
framework (organizational structure). The end result of the organizing process is
an organization — a whole consisting of unified parts acting in harmony to execute
tasks to achieve goals, both effectively and efficiently.
A properly implemented organizing process should result in a work environment where
all team members are aware of their responsibilities. If the organizing process is not
conducted well, the results may yield confusion, frustration, loss of efficiency, and
limited effectiveness.
In general, the organizational process consists of five steps (a flowchart of these steps
is shown in Figure 1):
Objectives are the specific activities that must be completed to achieve goals. Plans
shape the activities needed to reach those goals. Managers must examine plans
initially and continue to do so as plans change and new goals are developed.
Although this task may seem overwhelming to some managers, it doesn't need to be.
Managers simply list and analyze all the tasks that need to be accomplished in order to
reach organizational goals.
3.Classify and group the necessary work activities into manageable units.
Managers assign the defined work activities to specific individuals. Also, they give each
individual the authority (right) to carry out the assigned tasks.