In my previous article I analyzed the basic components and the steps of ICFR implementation in the company from scratch. In this article we will discuss how properly described and formalized business process simplifies the ICFR project.
Usually when business only starts to develop, all the key business processes are initiated by the founders or other employees, who are nominated to perform the business process for the first time.
Later as the business grows there are different scenarios for existing business processes in terms of formalization.
In some businesses there is no any visualized and formalized design of the processes, all employees know their roles, usual steps to perform, agree-upon deliverables. This scenario is sustainable if there is no significant employees’ turnover, the business is quite simple and stable and the founder is not very rigorous.
In some businesses, especially more complex and growing, it becomes obvious that in order to ensure continuity and further business growth, there should be some written rules and procedures. So most companies simply start with some description in informal flexible format, e.g. in MS Word. It depends on the level and skills of the employee who is initiating the formalization procedures.
Let me bring you a not-so-good example. The accountant responsible for AR and sales prepares a brief description of sales process and document flow only in relation to steps, which relate to his accounting duties. He prepares a 2-page MS Word document, not formalized, which covers only part of the process, not approved at any other level and not synchronized with other procedures on business processes.
The example demonstrates typical approach to the initial stage of formalization of business processes in most companies (especially small and middle-sized), which has the following weaknesses in terms of internal control environment and shareholder value:
Completeness and accuracy. The accountant is only one of many roles who participate in the process. That means that he could have lack of knowledge of some other procedures, steps and AR and sales process. He may not understand the whole picture.
Conflict of interest/ subjectivity. He is one of the employees working for the company and his personal interests could be different from the top management or founder’s strategic goals. His motives could be: easy achievement of KPI’s, thirst for power, any fraudulent or non-due actions.
No authorization from founder. It could be that the process described by the accountant does not correspond to the business goals.
How can top management/founder minimize the above-mentioned risks and corresponding weaknesses in the control environment?
The best scenario is to make an investment and delegate the formalization of business processes to relatively independent and professional party. It could be an in-house team: separate process re-engineering department or part of internal audit department (this option is worse as basically internal auditors should investigate and perform independent audit of internal controls). Or, it could be external professional consultant.
In both scenarios it is reasonable to obtain maximum benefit from this project. First of all you can formalize the situation «As is». Usually this is the first stage of business process formalization/re-engineering.
We usually start with diagnostics of the process. It is important at this stage to identify and split the whole process/function into sub-processes of several levels (business process tree). We usually use top-down approach in order to clearly understand the goals and purpose of each process/sub-process. For example, Sales process could be split into the following sub-processes:
First level: market research and pricing, preparation of commercial offer, search of clients, negotiations with clients, preparation and signing of contract, financial settlements, monitoring of contract execution.
Second level of processes by product, let’s take preparation of commercial offer, could be sales of trucks, sales of spare parts, guaranty services.
Depending on the size and complexity of the business there could be several levels of sub-processes. Usually the drill-down should stop at the level, where the process includes up to 5-7 roles. This is rather subjective but the reason that this is usually the maximum what you can draw on the one page slide in order to have clear, transparent view of the process steps, document flows and other components of the process scheme.
Interview and documents analysis
As soon as you have business process structure (tree), you start your investigation. The next step is interviewing roles and analysis of documents involved in the process. It is important to interview all roles involved in the process to get their description on how the process is organized what the document flow is, what the role of interviewee is, where the start and end of the process are, what the possible forks in the process are. Usually the first interview takes 1,5-2 hours. The interviewer also requests and investigates documents (testing sample), which were mentioned by the interviewee to go through them and to confirm that his understanding of the process is correct.
It is also important during the interview to ask interviewer to demonstrate his/her actions performed (e.g. in the software).
Best practice. It is important after the interview to make written brief protocol and to send it to the interviewee asking to review and comment if something was recorded incorrectly. It gives to the interviewer more confidence that the AS IS process is correctly understood and described in written.
There could also be follow-up questions or an additional interview if it is necessary to clear some missing or unclear steps.
Testing the process
In order to get the full verification of the AS IS process it is important to support the interview with reasonable testing process. Some reasons for that:
Example: Per interview with the AR and sales accountant he says that he issues invoice within 1 day after the full package of documents with a new customer is received (which includes signed contract, commercial offer, results of security check from security department with positive decision or acceptance of the customer). As a result of randomly selected invoices and supporting documents it becomes clear that the invoice is issued at the same time when the contract appears in the system. Accountant does not wait any other documents.
As you could see, these limited auditing procedures give more precise picture of the process compared to what may be described by the personnel and internal procedures.
Drawing a process scheme
Next step is to demonstrate the process AS IS in a scheme. Usually this is performed using BPMN approach in different software (MS Excel, MS Visio, ARIS or some other).
A BPMN (Business Process Model and Notation) defines a Business Process Diagram (BPD) which is made up of a set of graphical elements. A BPMN is based on a flowcharting technique tailored for creating graphical models of business process operations. A Business Process Model, then, is a network of graphical objects, which are activities (i.e., work) and the flow controls that define their order of performance.
Below is the example of the sub-process documented using BPMN:
As you could see, it describes full interaction between roles using formal language. I am not going to give all details (notation) of this language, since it is not the topic of this article. It is not very difficult and could be learned and used by any user.
The benefits of formalization in BPMN diagram are the following:
But most important advantage of formalized process is that looking at one standardized page with description of the process it is easier to identify any weaknesses or missing internal controls, which should be added or modified to effectively protect business from potential risks.
This topic is to be discussed in my next article.
