INTERNAL AUDIT

(PERTEMUAN KE-6)

BUSINESS PROCESSES AND RISKS

By: Bunga Indah Bayunitri, S.E., M.M., Ak., C.A.

MAPPING

BUSINESS
PROCESS PREFACE
OUTSOURCING

Ch 5
BUSINES BUSINESS
S RISK PROCESS
DOCUMENTIN
G BUSINESS
PROCESS
PREFACE

 This chapter examines how organizations

actually structure their activities to
implement their strategies and achieve their
business (organizational) objectives
BUSINESS PROCESSES

 What is a business processes?

Business Processes is the set of connected
activities linked with each other for the
purpose of achieving one or more business
objectives.
BUSINESS PROCESSES

3 Types of Business Activities (Exhibit 5-2):

1. Operating Processes:
Operating processes for most organizations include the
core processes through which the organization achieves its
primary objectives.

It is through these processes that organizations create

value and deliver it directly to their customer.

Classifications: (1) Understand environment, (2) Develop

Strategy, (3) Design Product/ Service, (4) Market & Sell, (5)
Produce product or Deliver Service (6) Invoice and Collect.
BUSINESS PROCESSES

Understand Develop
Environment Strategy

Design Product
or Services

Market & Produce Product

or Deliver
Sell Service
BUSINESS PROCESSES
2. Management and Support Processes:
Management and support processes are the activities that
oversee and support the organization’s core value-creation
processes.

While these processes will vary between organizations, they

generally are necessary across all industries an support, but do
not directly create, the value embedded in the organization’s
objectives.

Classifications: (7) Manage Human Resource, (8) Manage

Financial Resource, (9) Manage IT Resource, (10) Manage
Physical Resource, (11) Manage Compliance with Laws &
Regulations, (12) Manage External Relationships.
BUSINESS PROCESSES
Manage Human Resources

Manage Financial Resources

Manage IT Resources

Manage Physical Resources

Manage Compliance with Laws and Regulations

Manage External Relationship

BUSINESS PROCESSES
3. Projects:
Some organizations may use a different method to organize value-
creating activities, its called Project, is used when activities happen
over an extended period of time, require a complex sequencing, and
are relatively unique in that a specific activity is not done
continuously.

Classifications: (13)/(14) Scouting, Concept Development, Design &

Source, Execute, Operate (13)/ Handoff (14)
Process 13: Applies when the organization designs and constructs
an asset and operates it, as well.
Process 14: Applies when the organization designs and constructs
an asset and hands off to another organization to operate
BUSINESS PROCESSES

Proje Sco
utin
Con
cep
De Exe
cut O Ha
sig nd
ct g
(Ide
t
Dev
n&
e
(Im
pe off
ntif So (Ab
Oper y& elo ple ra and
pm urc me
ate
Ass
ess) ent e nt)
te on)

Conce Desi Execu

Scouti Hand
pt te
Project ng
(Identif Devel
gn &
(Impl
off
Deliver y& Sour (Aba
opme emen
Assess)
nt ce t) ndon)
BUSINESS PROCESSES
 General Sale

Deliver Invoice and

Market & Sell
Service Service

 Retail Sale

Customer Pays for Goods with Customer Accepts

Select Goods Cash or Promise to Pay Possession of Goods

 Store Sale

Customer Sales Clerk Customer

Customer
Selects Goods Enters Sales
and Goes to Into Cash
Pays Sales Receives
Checkout
Register Clerk Goods

 Internet Sale

Customer Logs
on to Website
BUSINESS PROCESSES
 Understanding Business Processes
For IA to add value and improve an organization’s
operations, they must first understand the organization’s
business model.

Add Value : is provided by improving ooportunities to

achieve organizational objectives, identifying operational
improvement, and/ or reducing risk exposure.

Strategy : Refers to how management plans to achieve

the organization’s objectives.
BUSINESS PROCESSES

2 common approaches to help in

understanding business processes:
1. Top-down Approach
Begins at the entity level with the
organization’s objectives, and then identifies
the key processes critical to the success of
each of the organization’s objectives.

(For high scale organizations)

BUSINESS PROCESSES

2. Bottom-up Approach
Begins by looking at all processes directly at
the activity level, and then aggregates the
identified processes across the organization.

(For small scale organizations)

BUSINESS PROCESSES

Once a process is identified, next step is to

determine the key objectives of the process.
Involves the question:
a. Why does the process exist?
b. How does the process support the organization’s
strategy and contribute to its success?
c. How are people expected to act?
d. What else does the process do that is important
to managements?
BUSINESS PROCESSES

For IA or someone not directly involved in the process,

the first sources of information is the process owner and
the existing policy and procedures documentation for the
process.

Ideally, process owner has established formal process

objective that provides the answers to the 4 question
before. If not, the IA will need to work with key people
involved with the process to obtain the necessary
information.
BUSINESS PROCESSES

Once the process objectives are understood,

the next step is to understand the input,
process, and output of the organizations.
Involves the existing documents:
a. Process procedural manuals
b. Policies related to the process
c. Job descriptions of people involved in the
process
d. Process maps that describe the process flow
BUSINESS PROCESSES

Next step is Monitoring the performance of the

process, using KPI (Key Performance
Indicator).

KPI : A metric or other form of measuring

whether a process or individual tasks are
operating within predescribed tolerances.
DOCUMENTING BUSINESS
PROCESSES

Documenting of the business process is required. It

should be done by the process owner and people
involved in the process.

Process documentation can be very effective in:

a. Orienting new personal;
b. Defining areas of responsibility;
c. Evaluating the efficiency of processes;
d. Determining areas of primary concern;
e. Identifying key risks and controls.
DOCUMENTING BUSINESS
PROCESSES

2 commonly used methods for documenting

processes:
1. Process Map : Pictorial representation of
inputs, steps, workflows, and output.
Exhibit 5-4
2. Process Narratives : often included along with
the process map to explain activities in more
detail also include descriptions of controls.
Exhibit 5-6
 Exhibit
BUSINESS PROCESS OUTSOURCING

Business Process Outsourching : The act of

transferring some of an organization’s business
processes to an outside provider to achieve cost
reductions, operating effectiveness, or
operating efficiency while improving service
quality.