LESSON 2:
Six Common Processes within an Organization
1. The Revenue Process
Related to those activities that exchange the organization’s
products and services for cash.
• credit granting;
• processing orders;
• delivery and shipping;
• billing to customers;
• maintaining accurate and reliable inventory records;
• the activities associated with accounts receivable;
• bad debt (including pursuing debtors and writing off
balances);
• reflecting the related transactions correctly in the
accounting systems.
2. The Expenditure Process
Those activities/systems involve in acquisition of goods, providing
of services, labor and property; pay for them; and classify,
summarize and report what was acquired and what was paid.
• ensuring that suppliers are stable, reliable and able to
provide the appropriate goods/services on time, at the
right price and to the required quality;
• the requisitioning of goods, services, corporate assets
and labor;
• receiving, securely storing and correctly accounting for
goods;
• all the activities associated with accounts payable (e.g.
matching orders to suppliers’ invoices and confirming
the accuracy of pricing, etc.);
• recruiting and correctly paying staff;
• ensuring that all taxes due are correctly calculated and
disbursed;
• ensuring that all the related accounting records are
accurate, up to date and complete.
3. The Production/Conversion Process
In this context, the term “conversion” relates to the utilization and
management of various resources (inventory stock, labor, etc.) in
the process of creating the goods and services to be marketed by
the organization.
4. The Treasury Process
This process is fundamentally concerned with those activities
relating to the organization’s capital funds, such as:
• the definition of the cash requirements and cash flow
management;
• allocation of available cash to the various operations;
• investment planning;
• the outflow of cash to investors and creditors (i.e.,
dividends).
5. The Financial Reporting Process
This process is not based on the basic processing of transactions
reflecting economic events, but concentrates upon the crucial
consolidation and reporting of results to various interested parties
(i.e., management, investors, regulatory and statutory
authorities).
6. The Corporate Framework Process
This process incorporates those activities concerned with
ensuring effective and appropriate governance processes and
external accountability. It is to do with the development and
maintenance of values, culture and ethics, and effective
management, strategic, infrastructure and control frameworks
that should aim to give form to the underlying direction, structure
and effectiveness of an organization.
More detailed/alternative point of view of processes
1. Cash process: The flow of cash into the business principally
through payments from customers, the custodial function with
regard to that cash and the conversion of the cash in settlement
of debts due principally to suppliers.
2. Information process: The gathering of data and its conversion
into information; the analysis of that information leading to
decisions which in turn result in data on performance.
3. Integrity process: “[the] controls over the creation,
implementation, security and use of computer programs, and
controls over the security of data files. These controls, technically
referred to as integrity controls, constitute a cycle because they
operate continuously from the time programs are instituted and
data are introduced into the computer records.”
4. Launching a new product process: The cycle that includes
market research, R & D, provision of necessary finance, tooling
up (or the equivalent), commencement of production and the
sales launch.
5. Payments process: “Transaction flows relating to expenditures
and payments and related controls over (among other activities)
ordering and receipt of purchases, accounts payable, and cash
disbursements.”
6. Planning and control process: Planning a course of action,
executing that action, measuring the results, comparing actual
performance with planned performance and deciding upon
corrective action.
7. Production process: “Transaction flows relating to production
of goods or services and related controls over such activities as
inventory transfers and charges to production for labor and
overhead.”
8. Product life process: Commencing with the processes of
launching a new product, through the routine production phase,
product revision and relaunch, product price adjustments, and
termination or decline of the product line.
9. Revenue process: “Transaction flows relating to revenue
generating and collection functions and related controls over such
activities as sales orders, shipping, and cash collection.”
10. Time process: “Not strictly related to transaction flows, this
cycle includes events caused by the passage of time, controls
that are applied only periodically, certain custodial activities, and
the financial reporting process.”
Standard Audit Program Guides
The standard set of Standard Audit Program Guides (SAPGs) is
subdivided into a number of separate Activities or Systems, each
of which is capable of free-standing audit use.
Most of these systems do not operate in complete isolation and
have both potential and actual bearing upon other systems.
THE HALLMARKS OF A GOOD BUSINESS PROCESS
1. Designed to meet objectives which are clear;
2. Has regard to competitive issues;
3. Performance can be (and is) measured;
4. Unsatisfactory performance is rectified;
5. Activities are completed in a timely way;
6. Processes are cost effective;
7. Controls are “preventative” rather than merely
“permissive”;
8. As few “movements” or “stages” as possible;
9. Unnecessary steps have been eliminated;
10. Proper authorizations;
11. Controls positioned as early as possible in the process;
12. Documented;
13. Has an audit trail;
14. Right people doing the right job;
15. Room for adaptation;
16. Defines risks within the process itself
Matching type
1. The flow of cash into the business principally through payments
from customers, the custodial function with regard to that cash
and the conversion of the cash in settlement of debts due
principally to suppliers.
2. The gathering of data and its conversion into information; the
analysis of that information leading to decisions which in turn
result in data on performance.
3. “[the] controls over the creation, implementation, security and
use of computer programs, and controls over the security of data
files. These controls, technically referred to as integrity controls,
constitute a cycle because they operate continuously from the
time programs are instituted and data are introduced into the
computer records.”
4. The cycle that includes market research, R & D, provision of
necessary finance, tooling up (or the equivalent), commencement
of production and the sales launch.
5. Transaction flows relating to expenditures and payments and
related controls over (among other activities) ordering and receipt
of purchases, accounts payable, and cash disbursements.”
6. Planning a course of action, executing that action, measuring
the results, comparing actual performance with planned
performance and deciding upon corrective action.
7. “Transaction flows relating to production of goods or services
and related controls over such activities as inventory transfers
and charges to production for labor and overhead.”
8. Commencing with the processes of launching a new product,
through the routine production phase, product revision and
relaunch, product price adjustments, and termination or decline
of the product line.
9. “Transaction flows relating to revenue generating and
collection functions and related controls over such activities as
sales orders, shipping, and cash collection.”
10. “Not strictly related to transaction flows, this cycle includes
events caused by the passage of time, controls that are applied
only periodically, certain custodial activities, and the financial
reporting process.”
Choices
a. Time process
b. Revenue process
c. Product life process
d. Production process
e. Planning and control process
f. Payments process
g. Launching a new product process
h. Integrity process
i. Information process
j. Cash process
LESSON 3: OPERATIONAL REVIEW PROGRAMS
Scope of SAPGs
Use of SAPGs
1. SAPGs are intended for use during management and
audit reviews of activities within an organization.
2. They raise the right questions and encourage
management and staff to consider whether controls are
satisfactory to address the issues raised. They provide
a self-documenting record of the progress of the control
self-assessment which is available for subsequent
audit or senior management review.
General Rule
1. Most SAPGs will be designed to cover systems which
have interfaces with other systems (for example, there
are logical linkages between purchasing, accounts
payable and stock control).
2. The principal activities of an operating unit or overseas
subsidiary can also be flexibly related to a number of
individual activity or system-based SAPGs
3. Away from the use of individual SAPGs to support the
examination of discrete activities, there is the
alternative view of a business expressed in terms of
business processes (or alternatively cycles, although
not every process is actually cyclic in form).
Format of SAPG
1. Title page
• The title page has three separate areas:
a. an area which records the details of the subject
matter covered by the SAPG and a reference
number.
b. an area used to record details about the specific
audit project.
c. a section which describes the control objectives for
the relevant system.
2. The risk/control issues
• Seq. column - contains a sequential number used to
identify each risk/control issue.
• These issues are divided into two groups
a) Key Issues which are identified by being both in the
sequence starting 1.1 and printed in bold text, and
b) Detailed Issues which are in the sequence starting
at 2.1.
The Key Issues reflect the top level and critical
aspects of the system/activity under review and
should always be considered by the auditor. There
are normally between six and ten key issues noted
on each system/activity SAPG.
The detailed issues examine the relevant subject in
greater elemental detail and should be addressed by
the auditor only if the responses obtained in relation
to the key issues suggest that there could be further
inherent weaknesses in control.
• Current Control/Measure column - It is used by the
auditor to record a brief description of any controls or
measures that are in place to address the issues raised
in the Risk/Control Issue column.
• WP Ref. column - It can be used to note any working
paper cross-reference.
• Effective Yes/No column - It is used to note whether the
recorded current control or measure is likely to be
 effective in either supporting the required objective or EXERCISE:
counteracting any underlying risk posed by the issue.
• Compliance Testing and Substantive Testing column - It Question Number 1. Which of the following numbers would likely
can be used to record the test applied and a summary impact the specific audit activity?
outcome.
• Weakness to Report - It can be used to note any points
of audit concern arising from the audit review and testing
which should either be discussed further with
management or formally reported to them as a
recommendation for action.

3. System interfaces - This page of the SAPG is intended to alert a. 5

auditors to the likely interfaces between the system or activity b. 6
being addressed in the SAPG and any others. c. 1
d. 3
RISK IN OPERATIONAL AUDITING
The internal auditor’s use of risk assessment can operate at Question Number 2. In relation to the problem, the auditor uses
different levels of audit planning and activity: 1 as evident supported, 2 evident supported with comments, 3
• At a tactical level the auditor may choose to apply risk no evidence at all. Which of the factors shall be used in control
assessment techniques to the potential universe of assessment if the cashier can’t explain the non-cancellation of
possible audit projects as a means of setting relative official receipt?
priorities, and thus determine those higher risk audit (1, 2, or 3?)
projects for inclusion into the annual audit plan. a. 3
• At the operational level, risk assessment linked to an b. 2
evaluation of control effectiveness can focus the c. 1
auditor’s attention on aspects of the subject under d. 0
review which are more deserving of his attention.
Question Number 3. If you are the auditor, would you assess the
Risk control as effective or not if you checked other days as sample
1. what is at risk and as you assessed the same scenario wherein cancelled receipts
2. how likely is it to be at risk. are not recognized and marked as cancelled.
a. not effective
the extent or size (inherent risk) of the risk and b. effective
the probability (control risk or system risk) of that risk c. effective with comments
actually occurring. d. highly effective

Exposure - In relation to risk, it is “an unwanted event or outcome

that management would wish to avoid” 1. Which of the following is a treasury function?
a. investment planning
Measuring risks b. ensuring that all taxes due are correctly calculated
and disbursed
Examples of risk exposures: c. ensuring that all the related accounting records are
1. Payroll accurate, up to date and complete.
2. Accounts payable department d. credit granting

Control Matrix 2. Which of the following is a product cost?

1. an expression of the type of exposure, on a category a. direct labor
scale of likely relative importance to the business b. selling expenses
2. likely extent (or the measure of the size) of the c. administrative expenses
exposure d. finance cost

Example 3. Which of the following costs are related to prime costs?

a. direct labor and direct material
b. direct labor and factory overhead
c. direct material and factory overhead
d. factory overhead and selling expenses

4. Financial reporting process is

a. controllership
b. treasurership
Measuring Control Effectiveness c. manufacturing
Overall control effectiveness is a product of two dimensions, d. conversion process
namely:
1. the potential effectiveness of a control activity 5. Which of the following is a hallmark of a good business
assuming that it is applied correctly all the time by staff process?
and management combined with a. unsatisfactory performance is rectified
2. the actual extent it is complied with b. as more “movements” or “stages” as possible
c. processes are cost inefficient
d. has fewer or no audit trail
INTRODUCTION TO INTERNAL AUDITING Organizational Structures of IA

Internal auditing is an independent, objective activity designed to

add value and improve an organization’s operations.

Internal auditing is critical to strong corporate governance, risk

management, effective internal control, and efficient
operations.

Corporate governance is the system by which companies are

directed and controlled. Boards of directors are responsible for
the governance of their companies. The shareholders' role in
governance is to appoint the directors and the auditors and to
satisfy themselves that an appropriate governance structure is in
place.

Risk management is the continuing process to identify, analyze,

evaluate, and treat loss exposures and monitor risk control and
financial resources to mitigate the adverse effects of loss. Loss
may result from the following: financial risks such as cost of
claims and liability judgments.

Value Proposition

• Offer objective assurance

• Provides insight
• Improve effectiveness and efficiency
• Long-term sustainability

The IPPF Standards of the IIA define assurance services as an

objective examination of evidence for the purpose of providing an
independent assessment on governance, risk management, and
control processes for the organization.

The Internal Audit Process It involves the 1. accumulation of facts and information, analysis
and reflection of the detail, 2. judgement about what it means and
3. drawing upon experiences to identify possible options to arrive
at a 4. solution. For most internal auditors this will sound very
familiar. The four faces of insight.

Assurance: Governance, Risk, Control

Core GRC principles

The three components of GRC are defined as follows:

1. Governance - refers to the ethical management of an

organization by its leaders in accordance with approved
business plans and strategies.
2. Risk - Risk management refers to an organization's
process for identifying, categorizing, assessing and
enacting strategies to minimize risks that would hinder its
operations and to control risks that enhance operations.
3. Compliance - refers to the level of adherence an
organization has to the standards, laws and regulations,
and best practices mandated by the business and by
relevant governing bodies and laws.

These three activities traditionally functioned more or less

separately. In a GRC approach, each of the three components
continues to interact with and support existing business functions,
but the intersection of the three is where the benefits become
apparent.
Insight: Catalyst, Analyses, Assessments (b) Whether the risks are under control
(c) Whether the risks are worth taking
Internal Auditing is a catalyst for improving an organization’s
effectiveness and efficiency by providing insight and Identifying Risks is Not Enough
recommendations based on analyses and assessments of data
and business processes. • Internal auditors evaluate the controls that help
organizations manage risks
• As catalyst for improvement, evaluates processes, • Are controls in place?
reports findings and recommends appropriate courses • Do the controls work?
of action; and advises on key projects/initiatives. • Are additional controls needed?
• Through analyses of data and information, provides • Any unnecessary controls?
insight into process improvements. • Are the controls cost-effective?
• Through understanding of the business and its
objectives, assesses the efficiency and effectiveness of
operations and protection of assets High Level Comparison
Objectivity: Integrity, Accountability, Independence
With commitment to integrity and accountability, Internal Auditing
provides value to governing bodies and senior management as
an independent source of objective advice.

• Grounded in professionalism and integrity through

professional Standards and Code of Ethics.
• Accountable in helping management and governing
bodies achieve their objectives.
• To ensure independence, CAE should report to
independent governing body for functional direction;
and to management for administrative oversight.
Maintains objectivity by not assuming any operational
responsibilities.

What do Internal Auditors do?

• Evaluate risks
• Assess controls
• Improve operations
• Review processes & procedures
• Assure safeguards
• Provide insight & foresight
• Communicate results & recommend action
When Does an Organization Need an Internal Audit
Function?

• Internal audit is not legally required in the U.S.

o Exceptions: NYSE-listed corporations and a
few specific industry/government
organizations
• Required in some countries
• Every organization, regardless of its size, should have
some type of internal control system/process
• The IIA believes that an organization is best served by
a fully resourced, independent and professionally
competent internal auditing function
Value of Internal Auditors
The Institute of Internal Auditors (The IIA)
• Find out what’s working and what’s not
• Keep an eye on the corporate culture The internal audit profession’s most widely recognized advocate,
• Look at the organization objectively educator, and provider of standards, guidance, and certifications.
• Bring organization-wide perspective Established in 1941, The IIA today serves more than 200,000
• Advocate improvements members from more than 170 countries and territories.
• Raise red flags www.theiia.org.
• Tell it like it is
• Trusted advisor International Professional Practices Framework

Internal Auditors Evaluate Risks The IIA sets the standard for the way internal auditing is practiced
around the world through the International Professional Practices
• Help keep bad things from happening Framework (IPPF).
• Help assure good things can happen
• Help management understand
(a) Where their risks are
STRATEGIC BUSINESS ANALYSIS
Operations Management - is the process of running a business in
accordance to the set standards and compliance set by the
operations personnel and other planners from different
departments of business.
• General Management
• Finance
• Marketing
• Human Resource
• Supply Chain
• Information Technology
• Security
• Other Functional Departments
Production of Goods Productivity Ratio Analysis
Types of Production
• Make to Stock (MTS) – the conventional; make then stock
• Made to Order (MTO)- “built to order” ; customized
• Make to Assemble (MTA) – a combination of MTS and
MTO; ex. Restaurants/fast food chains
• Just-in-Time (JIT)- focus on producing exactly the amount
you need at exactly the time your customers need it
Production of Goods Ration Analysis (PGRA) – forecasting
the finished product output/outcome of equipment, machines, or
tools during the production
Formula: 1 equipment/machine/tool : quantity produced
Example of Machine/Equipment/Tools capacity:
1 vending machine of beverage: stocked 80-100 pieces of in-can
beverage per month
1 computer laboratory : 30 computers
Example of Machine/Equipment/Tools Productivity Results:
1 vending machine of beverage with a stocked of 80-100 pieces
of an in can beverage per month: generates income of P2,400-
P3,000 (P30 average price of canned beverages)
Manpower Contribution Analysis
• “People are the greatest asset of the organization
• Hire the right resource, give proper training, provide right
compensation, etc.
• The old ways changed dramatically and it keeps on
changing
Manpower Contribution Analysis Formula:
1: Quantity, Product, Sales, and other performance measures
Sample Analysis of Tasks:
1 Accounting Staff : Number of invoices processed in a month
1 Security Guard: Safeguard Property of 500 square meters with
5 employees and estimated 100-200 customers
1 HR staff : 500 employees
1 supervisor : 16 staff
Sample of Analysis of Manpower Productivity Results:
1 accounting staff (who performs invoice processing for 3
entities): generates P90K revenue for the company)
1 security guard (who safeguards the property of 500 square
meters with 5 employees and has estimated 100-200 customers):
generates ~P100K-200K revenues for the company (P1K ave.
purchase x 100-200 customers)
Space Productivity Analysis
• Space productivity is essential in allocating proper
investment or resource to ensure attainment of goals
• You don’t just rent a space/construct a building without
space area consideration and plan
Floor Space Analysis formula: Productivity (sales) / sqm
Sample computation: P10,000/sqm = P2,000 sales productivity
per sqm
P10,000/100 sqm = P100 per sqm (as
rental rate
Typical Spaces analyzed in the business:
1. Floor Space
2. Gondola Space
3. Garment Racks
4. Table Racks
5. Wall Space
 6. Machine, Equipment, Tools and other fixtures space
7. Seating Capacity
8. Hybrid Space

Time and Motion Study Analysis

• A combination of both studies, time – F Taylor and

motion – F and L Gilbreth, thus time and motion
• is the process of knowing the performance of a specific
activity and corresponding time
• With the purpose to improve the performance

- Eliminate wastes

- Strengthen control

Project Management & Gantt Chart Analysis

• Project Management is the process of successfully

achieving goals by specified time and criteria through
managing tasks of team.
• Gantt Chart is a tool in project management used for
organizing workload in planned schedule and activities

- To ensure activities are completed as planned

Communication Structure Analysis (Internal and External) - To uncover issues
- To keep the project on track
• Corporate communication is the process of exchanging
ideas between the message sender and the receiver
• Business communication is the system of
Critical Path Method (CPM) and Program Evaluation Review
communicating strategies to discuss and implement
Technique (PERT)
while getting the stakeholder’s perspective such as the
customers. • CPM – is a technique in the project management that
• Communication makes transactions successful identifies the critical and non-critical activity or task to
perform
2 major communication focus in corporate communications
• PERT – is a project management tool that enable planners
1. Internal communication – used for protocols inside the to identify scheduled dates of activities and individual
business organization tasks based on planned timeline
2. External communication – for dissemination of • The critical path(s) – is the longest path (in time) from
information to external parties including customers start to finish. It indicates the minimum time necessary to
complete the entire project
 Sum it All and Reflections

• Production of Goods Productivity Ratio Analysis

• Manpower Contribution Analysis
• Space Productivity Analysis
• Time and Motion Study Analysis
• Communication Structure Analysis (Internal and External)
PERT has 4 kinds of time estimates used in project • Gantt Chart Analysis
management • Critical Path Method (CPM) and Program Evaluation
Review Technique (PERT)
1. Idealistic Time – the slightest sum of time to complete • Environmental Management
the tasks • Facilities Management
2. Pessimistic time – the greatest sum of time to complete • Project Management
the tasks
3. Most likely time – expecting there are no issues, the
finest time to complete a task
4. Expected time – accepted there are issues, the most
excellent assessment of how much time will take to
complete a task

Sigma = Pessimistic – Optimistic / 6

6 is a standard project management denominator to compute

consider the average of 4 and variance

PERT Variance = Actual – (P-O) in simple terms

Environmental Management

- Environmental management, in business perspective, is

the management of business taking into consideration the
effect of decisions that respond to the environment by
designing environmental process and system

Some salient PH laws to consider in the business operations

1. RA 9003 Ecological Waste Management Act of 2000
2. RA 9275 Philippine Clean Water Act of 2004
3. RA 6969 Toxic Substances, Hazardous and Nuclear
Waste Control Act of 1990
4. Presidential Decree 1586 Environmental Impact
Statement (EIS) Statement of 1978

Facilities Management

• Is the integrated management of place, people,

technology and process
• The effect of FM is to guarantee safety, efficiency, comfort,
and functionality of the place, people, technology and
process
• 4 Functions of FM
1. Supporting People – Space + People
2. Establishing Processes – crisis management
3. Facilities upkeep and improvement – innovations
and upgrades
4. Technology Integration – example building
badges, traffic count etc