INTAUD 3 – OPERATING AUDITING

TOPIC 8 : Business/Management Techniques and their Impact on Control

and Audit
INTRODUCTION
In this chapter we will examine selected business management
approaches, in respect of their nature allied to an awareness of their
potential impact on the control of operations and internal audit.

The following approaches will be discussed:

• business process re-engineering (BPR)
• total quality management
• delayering
• empowerment
• outsourcing
• JIT (just-in-time management)
BUSINESS PROCESS RE-ENGINEERING
Definition
BPR is normally a strategically driven programme of change which
concurrently affects the organization's structure, human resources,
systems and processes.
The process is usually both far-reaching in its effects and normally
represents a quantum leap in change terms.
It is often a realignment of the business processes to the core
organisational strategy of the business because they are regarded as
unsound.
Frequently it is the strategy itself which is being changed significantly
so that the business processes need to be brought in line with the
modified strategy.
 Business Process Reengineering involves the radical redesign of core
business processes to achieve dramatic improvements in productivity,
cycle times and quality.
Cycle Time is the amount of time a team spends actually working on
producing an item, up until the product is ready for shipment. It is the
time it takes to complete one task.
Business process re-engineering (BPR) is the act of changing an
organization’s major functions with the goal of increasing efficiency,
improving product quality, and/or decreasing costs. This starts with an
in-depth analysis of the business’ workflows and identifying key areas
that need improvement. People who do this kind of work, often referred
to as BPR specialists, are hired by companies to facilitate transitions to
more standardized processes.
BPR examples:
1.Business process reengineering examples: company selling
commemorative cards. In a company that offers products such as
Christmas, anniversary, commemorative cards, etc., renewing the
stock and changing the design of the cards is constantly
fundamental.

2. Ford Motor Company. Ford radically changed its accounts payable

(AP) process by implementing an online database that tracked the
process from purchase order to delivery and then automatically
made payment. The move to paperless invoices negated the need
for staff to spend time matching paper purchase orders with
receiving documents and invoices. By rethinking the purchase
process to take advantage of technology, the automotive company
reduced its AP department's head count by 75%.
Organizational structure is designed around the functions a business
performs (e.g., sales, marketing, finance, engineering, etc.).
An organizational chart is built around people and titles.
Organizational structure defines the purpose, accountabilities, and key
performance indicators (KPIs) for each business function and role.

A strategy is not simply a plan.

Having a plan does not enough to constitute having a strategy.
A strategy may contain a plan for implementation, but a plan alone is
not a strategy and a strategy is not simply a plan.

What does strategic mean in business?

Put simply, Business strategy is a clear set of plans, actions and goals
that outlines how a business will compete in a particular market, or
markets, with a product or number of products or services .
BPR is not essentially an IT project. It is driven by the business and
IT takes its place in the process as an enabling factor along with
employees, key business processes, etc.
Indeed, one cornerstone of the BPR approach is that it is holistic in
nature, in that change and development are viewed across a spectrum
of people, processes and technology, with the implications for all
being assessed and addressed.
Of course, the rapid pace of information technology change has, of
itself, offered greater and more flexible opportunities to the business
community.

Continuous Improvement
An alternative approach, which is less cataclysmic, is to apply a gradual
programme of continuous improvement to operations over a longer
time period.
In this situation, the affected operations may basically be sound and
only require small degrees of change to be applied, and then only to
selected elements of the overall process, for example the
modification of information technology systems.
Continuous improvement is normally a fundamental component of
total quality management (TQM).
However, there really is no reason why an organisation should not
implement a suitable cocktail of different techniques in order to
achieve its objectives.

What is TQM?
Total quality management (TQM) is the continual process of
detecting and reducing or eliminating errors in manufacturing,
streamlining supply chain management, improving the customer
experience, and ensuring that employees are up to speed with
training.
The Radicalism of BPR
Business process re-engineering is the re-engineering of business
systems. It has been called a radical change programme which is
designed to:
• reduce costs significantly
• make operations significantly more efficient
• find a competitive advantage.

The need for BPR is often driven by acutely unfavourable business

circumstances, but even without these a prudent management will
consider the competitive advantages which may follow from BPR.
It is better to be proactive rather than be forced to respond when a
crisis is upon the company.
BPR can be said to be a high risk technique as the aim is to achieve
high levels of improvement in a short timescale.
The Driving Force for BPR
The motivations for applying this technique will be varied, but the
continuing survival and development of the organisation are normally
at the heart of such radical change methods.
There may be, on the one hand, the fundamental need to refocus the
strategy of the organisation or alternatively external forces (such as a
new competitor in the market or changed economic conditions) may be
brought to bear. The following general examples may apply:

• increasing cost burdens squeezing profit margins;

• declining income levels from a given product or service,
suggesting that additional or improved service is necessary;
• inefficient usage of resources possibly linked to funding
limitations;
• poor productivity and efficiency levels when compared to
industry norms;
As with the application of any form of strategically driven technique,
top management should be seen as the driving force and be
responsible for the re-engineering initiative.
In order to enhance the possibility of success, the BPR project team
should include suitably senior and experienced managers.

Benefits from BPR

Very frequently, post BPR, the business is likely to be more closely
aligned with customer needs (“customer focused”) than before BPR.
All processes become geared to the customer. Staff and management
are likely to benefit from increased empowerment.
The IT systems will more closely correspond to need. Business costs
will have been reduced through downsizing, better asset management,
better supplier relationships and productivity benefits.
How BPR May Affect the Business
Although the results of BPR are intended to be beneficial, the process
has risks associated with it.
Staff are likely to be resistant to major change and morale may suffer.
The efficiency of running existing systems may be impaired as staff
resources are diverted to the BPR project.
The transition from the old systems to the post-BPR approach can be
unsettling and, unless planned with very great care, lead to major
breakdowns in business performance.
This is especially so as BPR usually involves the redesign of IT
systems. Customers may suffer in the short term even though they
should notice perceptible improvements after implementation of BPR.
In the short term BPR will be expensive as it is likely to entail major
investment of time by management and staff, and of capital by the
business itself.
If consultants are used, the business must be careful to ensure that it
does not lose ownership of the programme.
The following 11 general principles for a BPR project are taken from
Business Process Re-Engineering—A Practical Handbook for
Executives, by Stephen Towers:
1. A BPR programme will take strong leadership, substantial time
and real commitment.
2. Begin with a baseline assessment of your processes today.

3. Consultants are extremely useful in moving a BPR programme

forward.
11 general principles for a BPR project
4. Define BPR in quantitative terms, and set up a BPR directorate.
5. BPR should be institutionalised through structural changes
including “working groups”.
6. BPR means revised and revamped technology.
7. Successful BPR begins internally, within an organisation, before
it moves out to your business partners and customers.
8. Your organisation’s training budget will increase considerably,
but it’s worth it because BPR rests on the shoulders of your staff.
9. Staff motivation remains the most difficult aspect of BPR to get
right.
10. Expect that a percentage of your staff will not be able to measure
up.
11. Evaluate your risks, but don’t let them deter you.
The Implications for Internal Audit
The more major the change within a business, the greater the risk to
effective internal control.
BPR is intrinsically linked to major change. It is major change which
results in staff being more process or project oriented and less
functionally oriented: this very often reduces the extent to which
internal control is achieved through segregation of functions and
duties—and so alternative ways of achieving satisfactory control must
be implemented.
Internal auditors are often rightly asked to participate in the BPR
process. When BPR is being designed and implemented, invariably the
resources of the internal audit function will be targeted in large
measure to the new systems being developed. Internal auditors must
understand the BPR process in order to advise on the control quality of
the new systems.
Internal auditors should also be in a position to review the BPR change
process itself and advise whether that process has effective controls
built into it.

One particular risk is that of escalating costs associated with the BPR
project.
Internal auditors should be alert to the risk that established
controls may not be operated effectively during the BPR project as
management and staff resources are diverted to the BPR project itself.

The internal audit function itself may be the object of a BPR project,
perhaps as a part of a larger BPR exercise.
TOTAL QUALITY MANAGEMENT
Total quality management (TQM) is a way of managing to improve the
effectiveness, flexibility and competitiveness of a business as a whole.
More specifically, TQM is a management philosophy embracing all the
activities through which the needs and expectations of the customer,
the community, and the objectives of the organisation are satisfied in
the most efficient and cost effective way by maximising the potential
of all employees in a continuing drive for improvement.

A strategy can involve significant changes to an organisation’s

attitudes, priorities and controls. It is therefore a decision for
management. It is not the responsibility of internal audit. However,
internal audit departments will often take charge of the appraisal of the
organisation’s systems of control to monitor and assess the
implementation and operation of the new quality operations.
 Quality Systems
Quality assurance systems are systems which set out to demonstrate
to customers that a business is committed to quality and able to
supply its customers’ quality needs.
Standards for quality systems have been established which place an
emphasis on formalising individual systems, procedures and
associated quality controls.
Considerable emphasis is placed on documenting systems and
establishing what the standards of performance are to be.
One criticism of the quality assurance systems movement is that the
business seeking registration determines what its own systems will be
and what standards of performance will be achieved—these are not
externally imposed—they may not be very impressive in terms of
quality.
But they will be documented and registration is only achieved
after they have been appraised by accredited external independent
reviewers.
Since registration is dependent upon external assessment, internal audit
is not in a position to provide this service within their company.
They can, however, advise the company on how to set about the
process of obtaining registration, and assist the company to meet the
requirements for registration.
An internal auditing unit may make arrangements for one or more of its
staff to be trained and approved as ISO/BS assessors: they will not be
able to act as assessors within their business but the experience of what
is involved will be helpful to the business, assisting in avoiding the cost
of employing fee charging assessors over a period of many weeks to
analyse the improvements necessary to reach the standards required for
ISO/BS certification.
British Standard (BS)refers to the specification of recommended
procedure, quality of output, terminology and other details, in a
particular field making a product, managing a process, delivering a
service or supplying materials.
ISO certification is a seal of approval from a third party body that a
company runs to one of the international standards developed and
published by the International Organization for Standardization
(ISO). Either the whole business can seek registration covering the
organisation as a whole, or sections of the business may do so.
Many internal auditing units have gone for registration for a variety
of reasons:
• The high level of existing standardisation of internal audit
methods often means that an internal auditing unit is well
placed to prepare for and seek registration.
• Registration by internal audit sets a good example to the
business as a whole.
• Registration by internal audit gives internal audit practical
experience of what is involved—which it can then make use of
in the advice it gives to the rest of the company.
 One familiar element of a TQM programme is promotion of a culture

of continuous improvement which is based on the premise that those

involved in applying the various processes have the detailed
knowledge and are therefore best placed to improve them
Although the initiative for TQM and related continuous improvement
programmes will invariably stem from senior management (and be
actively endorsed by them), the basic responsibility for
improvements
In order to ensure that continuous improvement programmes are
successful, staff will need to be supported by suitable training in such
relevant techniques as effective team working, brainstorming,
problem identification, problem solving, and so on. As with any
rudimentary cultural re-orientation, it will take time to achieve the
The Cost of Quality
Unavoidably there are costs associated with maintaining a quality
environment, just as there are financial implications in instances of
poor quality.

Here we are concerned with categories of quality cost beyond those

associated with setting up the TQM environment and accreditation
processes.

Managers will need to identify quality costs in a number of categories

if they are to be in position to quantify the effects of possible
improvement and prioritise their improvement efforts in areas which
are likely to achieve significant savings.
Quality costs may apply in the following example areas:
• the prevention of defects (i.e. improved design and production
techniques/ practices);
• the monitoring of ongoing quality through inspection and
appraisal activities;
• the cost of correcting defective products or services prior to
delivery to the customer (i.e. internal failures);
• the costs associated with correcting defective products/services
detected after delivery to the customer (i.e. external failures).
This may include the cost of refunds, discounts, repairs or
replacements.

The last category should be of special concern as the reputation and

image of the organisation can be adversely affected and future trading
relationships put in jeopardy.
Quality Audits
Quality auditing is established in many businesses that have adopted
TQM and/or sought and obtained ISO/BS registration for quality
systems.
The quality audit process seeks to establish and maintain high
standards of TQM and/or quality systems
Some of the options for approaching quality auditing are:
• address these matters as part of the programme of work of the
internal auditing unit;
• run a separate quality audit function discrete from the internal
audit unit but with a full level of coordination between the two so
as to avoid duplication of work;
• have one audit department divided into two principal sections—
one for conventional internal auditing, the other for quality
auditing
 What is quality audit in TQM?
  It is a periodic, independent, and documented examination and
verification of activities, records, processes, and other elements of a
quality system to determine their conformity with the requirements
of a quality standard such as ISO 9000.

Quality auditing is the systematic, independent, and documented

review and evaluation of an organization's quality management
system (QMS) to determine whether quality activities and results
comply with a strategic arrangement that is effectively implemented
and appropriate to achieve the objectives.
What is quality audit example?
Quality audits can be an integral part of compliance or regulatory
requirements.
One example is the US Food and Drug Administration, which requires
quality auditing to be performed as part of its Quality System
Regulation (QSR) for medical devices.

ISO/BS standards stipulate the incorporation of self-audit procedures

into quality systems.
This represents an element of auditing with cost implications.
Quality auditing is not the same as internal auditing. It is an essential
part of TQM management philosophy and of a dedication to quality
systems.
 The internal audit approach ideally should be:
• to reassure management and the board that quality auditing is
being done effectively, and therefore to conduct internal audits of
the quality auditing processes. If internal audit are conducting the
quality audits itself, this will have to be done by others.
• to assess the extent to which internal audit can rely on work done
by quality audit where it overlaps with the scope of internal audit,
thereby avoiding unnecessary duplication.
In concluding this discussion of TQM, we note below a set of control
objectives and risk and control issues for the subject, which could be
used as the basis for developing an internal audit review programme.
Control Objectives for Quality Management
(a) To ensure that quality management techniques are
appropriately considered and utilised in order to improve
competitive advantage and the quality of service to customers.
(b) To ensure that the quality management approach is suitably
justified, authorised and documented.
(c) To ensure that senior management are committed to the relevant
quality strategy.
(d) To ensure that the costs of achieving and maintaining the quality
regime are accurately assessed and subject to monitoring
(e) To ensure that suitable quality and performance criteria are
established, which are capable of measurement.
Risk and Control Issues for Quality Management
1 Key Issues
1.1 Has the use of quality management techniques been the
subject of adequate research, justification and authorization
(and how is this evidenced)?
1.2 Has the quality management policy/programme been
documented?
1.3 Have the objectives of the quality programme been clearly
defined (i.e. in terms of potential competitive advantage,
improved customer satisfaction, etc.)?
1.4 How has senior management demonstrated its commitment
to the quality programme?
1.5 Have all the costs associated with the quality programme
been accurately and realistically identified, agreed and
authorised?
2 Detailed Issues
2.1 Have all the relevant operational procedures and policies
been updated in light of the documentary requirements of
the quality management scheme?
2.2 What processes has management applied in order to select
the most suitable areas for the quality initiatives?
2.3 What mechanisms prevent unsuitable business operations
being targeted with quality initiatives?
2.4 What prevents the implementation and operation of
unauthorised or unjustified quality schemes?
2.5 Have customer requirements been accurately identified
and taken into consideration?
2.6 How has the quality scheme been justified?
DELAYERING

Definition
Delayering simply means removing one or more levels of
management from the enterprise, or from a part or parts of it.
Delayering is the process of removing layers of management in order
to improve organizational efficiency.
This can be done by eliminating unnecessary levels of management,
consolidating functions, or flattening the organizational structure.

In simple terms, delayering is the process of removing red tape to make

your organisation function better.
It involves stripping out layers of management and hierarchy between
the lowest and highest levels, effectively flattening your company
 Potential Implications of Delayering for the Enterprise
Even within very modern organisations where organisation structure is
fluid and the structural emphasis is on project organisation or on
matrix organisation, you will find a hierarchical organisation
structure.
The number of levels of management and staff will vary according to
the historical evolution of the business and also according to the type
of business it is. Some enterprises, or parts of enterprises, are
appropriately very flat.
An implication of being flat is that each manager supervises a larger
number of subordinates.
This is called “the span of control” of the manager—an expression first
coined by Henri Fayol.
How wide the span of control of a manager can be depends largely
on these features:
• the extent to which subordinates are doing similar jobs;
• the extent to which subordinates need to be monitored and
helped;
• the degree to which the supervisory task is streamlined by
techniques such as IT-based reporting by exception;
• the extent to which the manager has fundamental work to
complete which does not involve supervising others;
• the extent to which the manager invests time reporting
upwards;
• the extent to which the manager expends time liaising with
collateral associates within the business;
• the extent to which the manager has a communication role
external to the business such as with the media and customers;
EMPOWERMENT
Definition
The delegation of responsibility to and trust of staff for making
business decisions, without the need for close, detailed review and
approval of those decisions.
This approach is based on the premise that employees, at all levels, are
responsible for their own actions and should be given the authority to
make decisions about their work.
Rationale for Empowerment
Determined cost-cutting (perhaps as one of the objectives of a business
process reengineering project and prompted often by acute competitive
pressures) frequently has the effect of giving more responsibility to
most staff.
Since there are likely to be fewer staff, it follows that the
responsibilities of most are likely to be greater.
This will also generally be the effect of greater automation, although
we should not overlook that many decisions are now
“programmable”—meaning they can be automated so that no member
of staff may have the responsibility to make these decisions.

Autonomy is the need that most closely corresponds to the concept of

“empowerment”. Autonomy means taking decisions and being able to
see the results which follow from those decisions.
If managers and staff are able to obtain more of their lives’ needs
through their work experiences, they are likely to be motivated to
focus on their job so as to fulfil themselves.
If empowerment confers the authority to make decisions, it is possible
that varying levels of service (i.e. to customers) will result through the
differing interpretations applied by individual members of staff.
In addition, there may be an attendant lack of clarity, in that it is more
difficult to discern who is responsible for what.

We should not overlook the other perspective which suggests that

have to make decisions; many people may be happier in a job that
enables them to focus on non work activities, such as hobbies, family
voluntary work, church etc. And a happy employee is better than an
unhappy one.
 OUTSOURCING
Meaning
Sometimes termed “contracting out”, outsourcing occurs when
services previously provided by in-house personnel are supplied by an
outside contractor.
This often takes place after a due process of market testing, which
requires that a fully specified tender document is prepared and
potential outside contractors are invited to tender for the work against
the specification.

The in-house personnel who previously provided the services

(sometimes known as the direct labour) may be invited to tender for
the work in competition with the outside tenderers.
 
A tender is a submission made by a contractor in response to an
invitation to tender. It makes an offer for the supply of goods or
services.
Tender Document means the set of papers detailing the schedule of
works, calendar of events, requirement of goods and services,
technical specifications, procurement criteria and such other
particulars, as may be prescribed for evaluation and comparison of
tender.
Broadening Scope of Outsourcing
In recent years there has been a general trend to outsourcing noncore
activities such as catering, security, office cleaning and, in the case of
local authorities, refuse collection. More recently, more fundamental
activities such as accounting, computer operations and site main-
tenance have been seen as candidates for outsourcing. Outsourcing
computer operations is normally termed facilities management .
JUST-IN-TIME MANAGEMENT (JIT)
The driving objectives of JIT are to eliminate wasteful or non value-
added activities, and by doing so achieve improvements (such as
increased quality, reduced work-in-progress stock levels, improved
productivity and reduced costs).
The radicalism of the technique will invariably mean the reassessment
and/or the casting aside of existing practices, and it is, therefore,
important that those involved approach the exercise with open minds.

A just-in-time (JIT) inventory system is a management strategy that has

a company receive goods as close as possible to when they are
actually needed. So, if a car assembly plant needs to install airbags, it
does not keep a stock of airbags on its shelves but receives them as
those cars come onto the assembly line.
The conceptual origins of JIT have a connection with the work of
Frederick Taylor early in this century and were really brought into
wider prominence by Japanese industry as an extension of their
struggles to survive after the Second World War.
One of the first practical working examples was implemented by
Toyota in the early 1960s.
What emerged was an integrated approach to managing production
which brought together a number of techniques, including JIT.
In 1982, Schonberger listed the 14 concepts associated with a
streamlined and focused approach to production, including such
elements as quality at the source, automation and robotics, minimised
set-up time, quality circles and just-in-time production. Information
technology systems, particularly those which are capable of
interfacing with suppliers’ IT systems, have made the contemporary
development and use of JIT feasible
It is important to understand that JIT manufacturing systems are
driven by the principle of being “demand-pulled” through the
production process, i.e. production activities are governed (or
“pulled”) by downstream processes requiring subassemblies from
upstream processes. This is the reverse of more traditional production
systems where the flow is “pushed” through the production chain.
Smaller production batches will usually apply in JIT systems and this
more readily facilitates other related aspects of the method to be
accommodated.

Pull principle is a production system where a manufacturing company

has explicit limit on the amount of work in process (WIP) that can be
in the system. In essence, there is a limit to the WIP.
Pull system
A production system dedicated by product sales and demand; a system
in which parts are delivered or produce only as they are needed by the
work center for which they are intended; requires only minimal
storage facilities.
Push System
The traditional production system in which work centers may produce
inventory that is not current needed because lead time or economic
production/order requirements; requires that excess inventory be stored
until needed.

A pull system initiates production as a reaction to present demand,

while a push system initiates production in anticipation of future
demand. In a pull system, production is triggered by actual demands for
finished products, while in a push system, production is initiated
independently of demands.
For example, the concurrent employee responsibility for ensuring that
the required quality criteria are met at the conclusion of each discrete
production stage, rather than relying on the more traditional quality
control inspection after the final production stage has been completed
and when it is more difficult to pinpoint the source of any quality
problem.

In tandem with the allocation of responsibility for quality matters,

employees can also halt the production process if a defect or problem
is discovered, thus permitting the (hopefully) prompt resolution of the
problem.
This approach is referred to as “quality at the source” and is based on
the Japanese concept of Jikoda which translates to “stop everything
when something goes wrong”.
The aims here are to minimise defects as an important contribution to
quality and to coincidently empower employees to identify and solve
them.
Coordination of the JIT process is clearly critical and this is
influenced, in turn, by effective communication along the production
chain.
A simple system of cards called Kanbans is normally used to send
signals between production workers.
The Kanban cards are used to instruct workers either to obtain the
parts required for their stage of the process (i.e. using the so-called
“move” cards) or to actually produce a number of parts (i.e. utilising
the so-called “production” cards).
Both types of card are attached to (and associated with) standardised
containers which physically flow through the production processes,
“pulled” by the downstream demands.

A kanban is a signaling device that gives authorization and

instructions for the production or withdrawal (conveyance) of items
in a pull system.
Kanban (Japanese for sign) is an inventory control system used
in just-in-time (JIT) manufacturing to track production and order new
shipments of parts and materials.
Kanban was developed by Taiichi Ohno, an industrial engineer at
Toyota, and uses visual cues to prompt the action needed to keep a
process flowing.
Data about the units of production and their progress is not only held
on the physical Kanban cards but tracked using IT systems which can
provide timely interactions with inventory records, accounting
systems, planning processes, and so on.
The JIT concept can apply beyond the in-house world of production
and have links to suppliers, in which case it is normally referred to as
just-in-time purchasing (JITP).
The principal aims of JITP are to reduce and contain stockholding
levels, improve the quality of parts and minimise all the associated
cost (i.e. of storage facilities).
JITP has implications for the selection of suitable suppliers who can
meet all the demands of the system of supply. Suppliers participating
in JITP schemes will have to become more flexible to enable the
call-off of smaller delivery quantities on a swift turnround basis.
Applying new techniques, such as JIT, will require that staff and
managers adopt a more flexible attitude to their thinking about the
processes under review.
They may have to reposition their existing concept of the situation and
embrace alternative viewpoints so that the revision will be successful.
The successful adoption of such philosophies presupposes that the in-
house culture is tuned to the same harmonious frequency, where the
employees’ contributions are also seen as coincidently contributing to
their motivation, fulfilment and self-esteem.
If so, the organisation can potentially benefit from a more committed
and creative workforce.
One manifestation of this enlightened attitude is the concept of
bottom- round management, which is typified by a consensus
management stance supported by the participation of been historically
viewed as the sole concern of management.
Finally, the Japanese believe in what they call "bottom round"
management.
This concept, sometimes called consensus management or committee
management, is an innate part of Japanese culture.
It involves a slow decision-making process that attempts to reach a true
consensus rather than a compromise.

**** END OF PRESENTATION ****