ELECTIVES PART OF REPORT

1ST TOPIC Suppliers, Inputs, Process, Outputs, and Customers Map

 Suppliers, Inputs, Process, Outputs, and Customers Map

 Auditors are expected to gain familiarity with the program or process they are going to review.
Two areas of weaknesses that sometimes complicate the completion of the review is the limited
knowledge of the parties involved and inadequate understanding of the process itself. Flowcharts
with swimming lanes often help to ameliorate this issue, but even those flowcharts often fail to
incorporate other critical components and participants in a process. As internal auditors apply
risk-based auditing techniques to their reviews, and increase their focus on the needs of
customers to achieve organizational aims, it is essential to gain a panoramic understanding of
the program or process.

 SIPOC is an acronym that stands for suppliers, inputs, process, outputs, and customers. All of
these items form the columns of the matrix. It prompts the audit team to consider:

Suppliers of the process

Inputs to the process
Process the team is reviewing
Outputs of the process
Customers that receive the process outputs

 The interactions among the parties involved can help to define risk exposures, the size of the
operation and related audit coverage needed, and customer requirements. It helps to answer the
following questions, among others:
Who supplies inputs to the process?
What is supplied and what material or informational inputs enter the process?
How critical are these inputs to the effective functioning of the program or process?
What does a high-level breakdown (or flowchart) of the process look like?
What does the program or process produce?
Who are the customers of the process?
What are the requirements of the customers?

 Poka Yoke/Mistake Proofing

Poka Yoke is the term used to describe a mechanism in a process that helps operators avoid
mistakes.

Poka Yoke is a Japanese term that means “mistake-proofing” (Avoid: yokeru, mistakes: poka).

The purpose of Poka Yoke is to eliminate defects in products by preventing or drawing attention
to human errors that can occur. A common expression to describe this condition is trying to fit a
square peg into a round hole—a frustrating and impractical action that is likely to yield unwanted
results.

 Examples from daily life abound:

Power plugs. Often they can only be plugged in one way because they don’t fit into the power outlet
upside down.
Microwave motors. The microwave oven stops operating when the door is opened
Automobiles. The driver cannot change the gears from park to drive, unless the brake pedal is
pressed.
 Poka Yoke can be a phenomenal tool for internal auditors who are often called upon to examine
the design of programs and processes, and make recommendations for improvement. The best
Poka Yoke solutions are as simple as possible, use the lowest cost solutions, make the solution
mandatory and intuitive, and avoid requiring the operator to make a decision to apply the solution
or not (Table 6.10) In industrial settings, forcing parts to fit only one way by adding pins or other
obstructions that makes it impossible to fit them any other way helps to avoid parts from being
put in incorrectly.

 The following lists some of the common ways of mistake-proofing processes:

Orientation. Part won’t fit incorrectly.
Sequence. Process must be performed in a predetermined sequence.
Weights. Inaccurate weights forces the machine to stop.
Location/size/count. Requires the presence, absence, or different size of components.
System check. Machine stops operating when out of specification.

 If we apply Poka Yoke in a service environment, it becomes evident that the principles are
equally applicable. Note the following examples:

Spreadsheets. Color-code and password-protect the spreadsheet so data can only be entered on
predetermined fields.

Reconciliation templates. Use formulas with check totals that indicate through color changes when
the totals agree.

Data entry. Operator is required to reenter certain figures to make sure data entry is accurate.

Expense reports. System automatically displays a child window when the amount of the expense is
above a given threshold.

Entry-log. Information is selected from a pull-down menu for company employees, or typed for
visitors to eliminate penmanship issues—an often overlooked limitation of sign-in sheets where the
security officer doesn’t pay attention, or can’t decipher, the names written on the entry–exit log.


 Benchmarking
While they were saying among themselves it cannot be done, it was done.

Helen Keller*

 Benchmarking is the process of comparing statistical information. It consists of comparing at

least one performance metric to a standard, or multiple performance metrics to each other. It is a
great tool to determine if the item under examination is performing at an acceptable level. The
results can show that the item is performing below the standard, or above it, in which case the
item could become the new standard.
 Typical metrics used in benchmarking are time, quality, and cost. In most cases, benchmarking
consists of identifying the best performing organizations in the same or another industry where
comparable processes exist and comparing one’s results to those of the other organizations.The
result can be a better understanding of how well or poorly the process or overall organization
compares, but also why organizations are successful. It is often best not to benchmark only
once, but rather to make this a continuous process linked to one’s continuous quality
improvement initiatives, ERM, and audit planning.
 Two common issues associated with benchmarking are:
(1) The information is often proprietary and organizations are reluctant to share it with other
organizations, especially competitors
(2) The information is sometimes not comparable, because the organizations are of different sizes,
maturity, or operate in different markets.

 By performing benchmarking analyses within the organization, the information should be

more readily available and it can serve as a great way to identify centers of excellence within
the organization itself.
A third approach is to perform trend analysis where the unit being examined is compared to
itself over time. This third approach raises the issue of “how long should be the time period of
an operational audit?” If a metric is viewed during a 1-year cycle, the number may provide
one perspective or even appear satisfactory, but if we examine multiple years, we may arrive
at a different result. For example, a call center has been receiving a similar volume of daily
phone calls over a 5-year period, and its average response time is as shown in Table 6.12.
  Five Whys

If you do not ask the right questions, you do not get the right answers. A question asked in the right way
often points to its own answer. Asking questions is the A-B-C of diagnosis. Only the inquiring mind
solves problems.
Edward Hodnett*

 The 5 Whys is a very powerful tool, useful to identify the root cause of issues. Many auditors
are accustomed to treating situations using a binary approach. When performing financial
audits in the United States, transactions are either compliant with US Generally Accepted
Accounting Principles (GAAP) or they are not. If they are, there is no finding. If they are not,
they must be corrected and recorded according to US GAAP. The situation is binary

 The 5 Whys is an iterative technique used to explore the cause-and-effect relationships

underlying a problem. The primary goal of the technique is to determine the root cause of a
defect or problem by repeating the question “why?” The process is sequential and each
question forms the basis of the next question. The “5” in the name is the typical number of
iterations typically needed to resolve the problem, but identifying the root cause may take
fewer or more times than 5 whys.

 Suppose the auditor notes that the processing unit is making mistakes when shipping goods
to customers.

Why 1. Why are there so many mistakes? Because instructions are given verbally.
Why 2. Why are instructions given verbally? Because it takes longer to write orders and they
want to make shipments as quickly as possible, so they call the orders in.
Why 3. Why does it take so long to write orders? There is no tool (e.g., form, template, and
system) to record the information.

 Work Breakdown Structure

According to the Project Management Institute (PMI), a Work Breakdown Structure (WBS) is a
“deliverable-oriented grouping of project elements that organizes and defines the work scope of
the project. Each descending level represents an increasingly detailed definition of the project
work.”*It includes the tasks that must be done to complete the project and these tasks are
arranged in hierarchical order. This way, the larger jobs that must be done, followed by the
smaller tasks needed to do the larger jobs, and so on in more and more detail until arriving at the
most detailed tasks needed. This is called “de-composition” and it is done step by step with
increasing detail. The stopping point is when there is enough detail to estimate staff, resource
needs, costs of the task, and the risks associated with getting that task done.
  Each item should be numbered to keep track of everything in the project. Since this creates
strings or chains that resemble outlines, it provides an easy way for the project manager (PM)
and team to trace tasks up and down the chain with increasing or decreasing detail.

 A WBS is best prepared with the input from others who have done similar work in the past or the
project team, who will be doing the actual work.

Summary

As we consider all of the tools covered in this section, it is important to remember that they serve as
tools to help internal auditors identify the root cause of problems. RCA is a concept often mentioned by
internal auditors, and for some, it is almost an elusive goal. It is perceived as a high value outcome
because not identifying the root cause of a problem carries consequences to the auditor and the
process under review. When the recommendation to correct a problem only addresses symptoms rather
than the source of the problem, the problem recurs.

In everyday life, it is easy to understand the difference between treating the symptoms of a malady and
curing the condition itself. A classic example is that of headaches. A person can treat the headache with
a variety of pain medications, but unless that individual addresses the underlying source of the problem,
the headaches will continue. Headache sources may include alcohol consumption, certain food
additives, stress, changes in sleep patterns, eye strain, sinusitis, fatigue, and dehydration, so unless the
underlying lifestyle practice or medical condition is addressed the headaches won’t go away
permanently.