Module 6 – Tools

ACELEC 332
INTRODUCTION

▪ Internal auditors have a very challenging job to do and over the last few years, it has become
increasingly apparent that business dynamics, related risks, and the amounts of data that must be
examined have increased much faster than the staff levels of internal audit departments.

▪ Even when the number of internal auditors has increased, the headcount is not enough to handle
the expanding number of responsibilities.

▪ In this environment of demands exceeding the availability of resources, internal auditors must use
new and innovative tools and techniques to meet their responsibilities.
▪ In this section, we examine 16 tools ranging from highly quantitative to qualitative ones. They
provide diverse means of gathering information, analyzing it, presenting it, and serving as tools to
persuade our clients that either conditions are satisfactory or that they need corrective actions.

▪ These tools were developed by experts in the fields such as statistics, economics, mathematics,
quality control, and management, and include Vilfredo Pareto, Joseph M. Juran, W. Edwards
Deming, Walter Shewhart, Genichi Taguchi, Karl Pearson, Kaoru Ishikawa, and many others.
(1) HISTOGRAMS

▪ Histograms are charts that show the frequency distribution of numerical data using rectangles,
each of which represents intervals. They display the probability distribution of a continuous
variable.

▪ Histograms are used to assess the distribution of data and help to identify how the data points are
distributed. In so doing, the information is more than a picture of the data points, but instead
shows a flow of the data. This can be very useful for the auditor and very helpful to understand the
dynamics affecting the process under review. Rather than simply focusing on the total transactions
during a period, histograms provide what I refer to as a fluid view of the transactions.
(2) CONTROL CHARTS

▪ A control chart is a graph used to plot and study how a process changes over time. Data are plotted
in time order, in a similar fashion as run charts. A control chart has a central line for the average or
target value for the process being plotted, an upper line for the upper control limit (i.e., maximum
allowable value given the established performance specifications) and a lower line for the lower
control

▪ Control charts can help auditors determine if the process is stable under control. Furthermore,
these charts can be used to predict the future performance of the process and if the process is not
in control, an analysis of the chart can help to identify the source of the problem.
(3) PARETO CHART

▪ The Pareto principle, also known as the 80/20 rule, posits that for many events approximately 80%
of the effects are caused by 20% of the causes. This principle essentially means that there is a
concentration of sources that internal auditors should identify for best results.

▪ Pareto diagrams are designed to organize data and can be used to prioritize improvement effort by
focusing on major root causes of the problems under review. The focus is to focus on the root
causes and look for cause and effect relationships. The grouping can derive from data analytics,
where the analyst looks for concentrations of the data.
(4) CAUSE AND EFFECT (Fishbone, Ishikawa) DIAGRAM

▪ One of the best tools to help identify contributing causes of an issue, and hone into the root cause most
accurately. This tool is also called cause and effect diagram or Ishikawa diagram for the name of the
person who invented it, Kaoru Ishikawa.
▪ When searching for the root cause of issues, auditors are effectively searching for the source of
variation, which are often grouped into categories. The following six categories are often used:
▪ People. Individuals involved in the process.
▪ Methods. How the process is performed and the requirements for doing it. This may include policies,
procedures, regulations, laws, and rules.
▪ Machines. Any piece of machinery, computers, tools, or equipment required to perform the work.
▪ Materials. Inputs used to produce the product. This may include raw materials, parts, semifinished goods, and
paper.
▪ Measurements. Data used to evaluate the quality of the process.
▪ Environment. Conditions in which the process or activities are performed. This may include time,
location, temperature, humidity, noise, and culture.
(5) FORCE FIELD ANALYSIS

▪ This is a great decision-making tool to identify the forces for and against a course of action. It is a
technique to list, discuss, and evaluate the forces that support or hinder a decision. It can also help
to strategize the best way to present the information by understanding the big picture and the pros
and cons of the recommendation. Lastly, it forces the proposal advocate to “walk a mile in the
auditees’ shoes.” By understanding the auditees’ perspective, the auditor is more aware of the
challenges that the client faces and shows empathy during the process.

▪ Force field analysis is useful to resolve conflict of opinions, comparing pros and cons of a decision
and to evaluate the strength and weaknesses of an idea, product, or project.
(6) FLOWCHART/PROCESS FLOW MAP/VALUE STREAM MAP

▪ A flowchart is a diagram that represents a workflow or process. It shows the steps in the form of
boxes of different shapes and the order or sequence of events by connecting the items with
arrows. Flowcharts are used to design, document, manage, and analyze a program or process in
virtually any field by presenting the process flow in visual form.

▪ While flowchart is arguably the most common name given to this tool, it is sometimes also called
process flow diagram, process map, process model, and workflow diagram. Although some argue
that there are differences between each of these, the only distinction is that flowcharts merely
show the activities performed, while process flow diagrams include details, such as who performs
the activity, the amount of time involved in either performing activities or waiting for the next step
to begin, data and information flows as well as bottlenecks, delays and rework.
Common Process Improvement Areas
▪ When reviewing processes, it is often helpful to search for the following items to determine if the
following areas present opportunities for improvement:
▪ Backlogs. These represent an accumulation of work, often in the form of uncompleted work that needs to
be done. This could consist of transactions to process and orders to execute. This can be problematic if
there are deadlines that should be met either because there are rules or regulations requiring them, or
customers depending on the completed work for them to perform tasks of their own.
▪ Cycle time. Cycle time is the total time from the start to the end of a process. There may or may not be
clear standards regarding transaction completion times, but in general, quick execution is a general
expectation. With that in mind, delays and bottlenecks are anomalies worth correcting since they result in
cost accumulation and possible customer dissatisfaction.
There are several ways to capture process cycle times:
▪ Stop-watch. In this case, the auditor can document how long it takes to process the various steps in a
flowchart and build a piece-by- piece schedule, with the sum being the total time for the corresponding
transaction.
▪ Systems data. Some information system can provide detailed cycle-time information through their
reporting functionality. When that is not available, document flow management applications often
capture user ID, date, and time every time a user accesses a transaction record.
▪ Sample. After selecting the sample of transactions to test, the auditor can expand the data capture
during the review. Auditors often review individual files and test financial and compliance controls,
checking for
▪ a. Accuracy. What the customer asked for is what the customer received.
▪ b. Completeness. All the transactions that constitute a customer request, were executed.
▪ c. Authorization:
▪ i. Every transaction was business related
▪ ii. Every transaction was reviewed and approved as required
(7) TAKT TIME

▪ Takt time is the rate at which the production operation produces output. The term is derived from
the German word “takzeit” that translates to “rhythm.” It relates to the average amount of time, or
pace, of activities. In this case, it relates to the amount of time to perform each activity.

▪ It has a deeper connotation than the word “rate” may suggest. It is the rhythm or heartbeat of the
operation, and it is the pace at which everyone in the process works to keep capacity aligned.
Without takt time, there would be inventory between workstations and possibly shortages of
material between others.

▪ This metric can be used to determine the pace to keep a process flowing, so there are no
bottlenecks in a process. In fact, a bottleneck results from the demand in a process, or number of
transactions entering a process, exceeding the ability of the operators to do the work and make the
transactions exit the process. It can also be used to set the performance expectations for the
process, so operators know what their goal is so they can meet or surpass it.
Eight Areas of Waste
▪ Waste reduction is imperative to increase profitability and better utilize the limited resources that
most organizations operate with. Waste occurs when more resources are consumed than
necessary to produce the goods or services the customer wants. Taiichi Ohno, Toyota’s chief
engineer, developed the “seven wastes” as part of the Toyota Production System.
▪ Transporting
▪ Unnecessary inventory
▪ Excess motion
▪ Waiting
▪ Unnecessary processing or paperwork
▪ Defects
▪ Overproduction
▪ Underutilized employees
(8) AFFINITY DIAGRAM/KJ ANALYSIS

▪ Affinity diagrams, also called affinity charts or the Jiro Kawakita (KJ) method, are very useful tools
that can help auditors organize ideas and large amounts of data.

▪ Affinity diagrams are useful to gather large amounts of data, organizing the data into groupings or
themes (i.e., creating clusters based on the affinity that some items have to others), when you
need group consensus, and when issues seem too large and complex to organize.

▪ Affinity diagrams require the following materials: sticky notes or cards (e.g., Post It Notes) and a
large work surface to work on (e.g., wall and table).
(9) CHECK SHEET

▪ A check sheet is a structured form or document used to collect and analyze data. This is often done
real time where the data are generated or collected. The information collected can be either
qualitative or quantitative and the form is sometimes called a tally sheet because the data are
often used to track and count the number of instances of various phenomena associated with the
review being performed. Check sheets provide a tool to consistently capture information about
transactions examined.

▪ Check sheets can be used when the data are observed and collected repeatedly and the intent is to
document the frequency or pattern of problems, defects, defect causes, or events.
(10) SCATTER DIAGRAM

▪ A scatter diagram is a visual tool for analyzing pairs of numerical data and showing the relationship
between two variables. It is sometimes called a scatter plot or an X–Y graph, with one variable on
each axis. One variable is plotted on the horizontal axis and the other is plotted on the vertical axis,
and if the variables are correlated, the points will fall along a line or a curve.
5S
▪ 5S is the name of a workplace method
that uses a list of five Japanese words
to describe how to clear, organize, and
maintain the workspace for efficiency
and effectiveness by identifying,
storing, and maintaining the items
used, maintaining the physical space
and items, and sustaining the
arrangement. These Japanese words
are seiri, seiton, seiso, seiketsu, and
shitsuke. When transliterated into
English, each starts with the letter “S.”
(11) RACI DIAGRAM

▪ The RACI diagram, also referred to as responsibility assignment matrix, and linear responsibility
chart, is a very useful tool to help correct this deficiency. RACI is an acronym derived from the four
roles and responsibilities that various parties play in a program or process. It describes the
participation by various roles in completing tasks or deliverables and it is especially useful in
clarifying roles and responsibilities in cross-functional or departmental projects and processes
because it identifies who does what. The roles identified are responsible, accountable (or
approver), consulted, and informed.
▪ Responsible – This describes those responsible for performing the task and refers to those who do the
work to achieve the task. It answers the question: Who does this?
▪ Accountable (Also Approver) – This identifies the person that approves the completed activity. It answers
the question: Who approves the activity after it is completed?
▪ Consulted – Those whose knowledge is important for the successful completion of the task are identified
as consulted. It answers the question: Who will assist the people responsible?
▪ Informed – This role refers to anyone that should be kept up to date about the activities being performed,
the progress made on them or their completion. It answers the question: Who should be kept up to date
about the activities?
Communications Plan
▪ A communications plan is very simple to
prepare and very useful to make sure
communications within and outside the
team are effective. The means of
communication can be formal or
informal. However, it is usually best to
make most of them formal to ensure
consistency, provide the proper coverage,
and make sure this happens promptly.
Informal communications are also very
important and serve as a great
supplement to formal communication
channels and activities.
Communications Matrix
▪ While the communications plan provides a framework for communicating, the communications
matrix is used to summarize and facilitate the communication plan by defining the details
regarding the communications activities that are used during the team or department’s activities
during the project.
(12) SUPPLIERS, INPUTS, PROCESS, OUTPUTS, AND
CUSTOMERS MAP

▪ A suppliers, inputs, process, outputs, and customers (SIPOC) diagram can be very helpful in that
regard because it summarizes the participants, inputs and outputs of a process. An SIPOC diagram
is a tool used by a team to identify all relevant elements of a process before work begins.

▪ SIPOC is an acronym that stands for suppliers, inputs, process, outputs, and customers. All of these
items form the columns of the matrix.

▪ The SIPOC map is particularly useful when defining the scope of the review because it can give
auditors a high-level overview of the program or process. All the elements captured in the SIPOC
map are important to fully understand what the auditors are going to review.
(13) POKA YOKE/MISTAKE PROOFING

▪ Poka Yoke is the term used to describe a mechanism in a process that helps operators avoid
mistakes. Poka Yoke is a Japanese term that means “mistake-proofing” (Avoid: yokeru, mistakes:
poka). The purpose of Poka Yoke is to eliminate defects in products by preventing or drawing
attention to human errors that can occur. A common expression to describe this condition is trying
to fit a square peg into a round hole—a frustrating and impractical action that is likely to yield
unwanted results.

▪ Poka Yoke can be a phenomenal tool for internal auditors who are often called upon to examine
the design of programs and processes and make recommendations for improvement. The best
Poka Yoke solutions are as simple as possible, use the lowest cost solutions, make the solution
mandatory and intuitive, and avoid requiring the operator to decide to apply the solution or not.
(14) BENCHMARKING

▪ Benchmarking is the process of comparing statistical information. It consists of comparing at least

one performance metric to a standard, or multiple performance metrics to each other. It is a great
tool to determine if the item under examination is performing at an acceptable level. The results
can show that the item is performing below the standard, or above it, in which case the item could
become the new standard.

▪ Typical metrics used in benchmarking are time, quality, and cost. In most cases, benchmarking
consists of identifying the best performing organizations in the same or another industry where
comparable processes exist and comparing one’s results to those of the other organizations. The
result can be a better understanding of how well or poorly the process or overall organization
compares, but also why organizations are successful. It is often best not to benchmark only once,
but rather to make this a continuous process linked to one’s continuous quality improvement
initiatives, ERM, and audit planning.
(15) FIVE WHYS

▪ The 5 Whys is a very powerful tool, useful to identify the root cause of issues. Many auditors are
accustomed to treating situations using a binary approach. When performing financial audits in the
United States, transactions are either compliant with US Generally Accepted Accounting Principles
(GAAP) or they are not. If they are, there is no finding. If they are not, they must be corrected and
recorded according to US GAAP. The situation is binary.
▪ The 5 Whys is a one of the simplest tools for RCA. It is easy to use and does not require statistical
analysis. The approach consists of asking “why” multiple items, each of which probes further as to
the source of the problem.
▪ The 5 Whys is an iterative technique used to explore the cause-and-effect relationships underlying
a problem. The primary goal of the technique is to determine the root cause of a defect or problem
by repeating the question “why?” The process is sequential, and each question forms the basis of
the next question. The “5” in the name is the typical number of iterations typically needed to
resolve the problem but identifying the root cause may take fewer or more times than 5 whys.
(16) WORK BREAKDOWN STRUCTURE

▪ A Work Breakdown Structure (WBS) is a “deliverable-oriented grouping of project elements that

organizes and defines the work scope of the project. Each descending level represents an
increasingly detailed definition of the project work.”*

▪ It includes the tasks that must be done to complete the project and these tasks are arranged in
hierarchical order. This way, the larger jobs that must be done, followed by the smaller tasks
needed to do the larger jobs, and so on in more and more detail until arriving at the most detailed
tasks needed. This is called “de-composition” and it is done step by step with increasing detail. The
stopping point is when there is enough detail to estimate staff, resource needs, costs of the task,
and the risks associated with getting that task done.

▪ A WBS is best prepared with the input from others who have done similar work in the past or the
project team, who will be doing the actual work.
End of Module 6