Required

Summary

LEAN RISK ASSESSMENTS Emphasizing management's needs and continuous improvement can enhance can management and includes identifying and this aspect of Lean manage- internal audit's risk production practices eliminating processes and ment, the emphasis is on are modeled after the assessments. costs that do not add value to customer satisfaction-spe- Toyota Production customers. In the case of the cifically the value added to System, which focuses on risk assessment, the key cus the customer, referred to two axioms respect for peo- tomer is management. Con as value stream manage- ple and continuous improve tinuous improvement refers ment. This process involves ment. Respect for people more to creating and main- concentrating on what the includes respect for the needs taining systems and processes customer wants as expressed of employees, the environ for continuous improvement, by what he or she is willing ment, customers, strategic not just creating incremental to pay for Customer consid- partners, and host communi- improvements. In Lean pro- erations include features, ser ties. Continuous improve cessing, improvements are vices, and quality, as well as ment refers to continuously driven by employee involve- the time between customer enhancing processes, particu- ment and include a drive demand and delivery (cycle larly as they are driven by toward zero defects. time). For some customers employees throughout the One example of the fun- this also will include respect organization. As more orga- damental changes that take for the environment. These nizations move toward Lean place is how product inven two changes, coupled with practices, internal audit must tory is thought of, planned other changes in the cost and be involved, especially in for, and managed. Tradition- pricing structures and finan- how the organizational risk ally, inventory is considered cial management parties assessment is performed an asset, partly because of in Lean management, have a and communicated the high costs of set-up in significant effect on the way the production process. In the risk assessment needs to What is Lean Processing? Lean processing, set-up costs be conducted and reported. Lean management moves are greatly, if not entirely away from the traditional reduced through process Assessing Risk emphasis on revenue gen- improvement and inventory As the organization makes eration and profitability to is considered to be waste. changes to adopt Lean concentrate on the customer Another big change is management practices value stream through con- the transition from target the internal audit function tinuous improvements. This pricing to target costing. In must change to increase the department's service levels and value to the organization. In the means to mitigate them. Internal audit also may need its risk assessment, internal audit must determine the risks to to explain why typical risks that were previously included in the organization associated with this new paradigm: how to the assessment have been moved off the grid because of the measure, quantify, and mitigate them. Although these changes changes Lean management has brought about. After com- vary among organizations, internal audit must consider the pleting the risk assessment, internal audit should survey man- opportunity cost of not continually improving, and thus fall- agement to determine its effectiveness and how the process ing behind the organization's competitors and becoming irrel- and report can be improved the following year. evant to its customer base. Because employees are fundamental Another key practice is to continuously improve internal to the process, there must be a measure of their engagement. audit processes. Because staff participation is a key factor in Benchmarking also is needed to measure improvements in this process, auditors should always seek and share ways of improving the process and the report. Internal audit also should include The risk assessment should evaluate benchmarking to keep up with best practices in the profession. This should the effectiveness of Lean processes. include an annual review of technology updates and advances such as analytics software. Auditors also should review the cost structure internally and with competitors. Internal how internal audit can benefit from emerging technology audit can provide input to management as it seeks to define, such as social media, particularly the use of social media as a develop, and collect data on these measures. business strategy. Internal audit should never accept the sta- The other major area of concern is respect for various tus quo in its processes. stakeholders and the environment, which should be a con- cern and benefit to all stakeholders. These interests typically Organizational Processes Internal audit should develop don't have a "voice" in risk deliberations, making them easier risk assessment procedures that evaluate the state and effec- to overlook. As such, they may be the most difficult areas in tiveness of the Lean processes within the organization. While which internal audit must adapt its risk assessment. When this is a typical procedure during the risk assessment, internal internal audit is measuring risks to revenue generation and audit will need to adapt the procedures to the new risk areas profitability, the measures are more straightforward because identified in Lean management. they generally are more objective, numeric values. Measuring respect is more subjective. Internal audit can make a major Risk Reporting To add value to its reporting, internal audit contribution to the process by assisting, or even leading, in should adapt the risk assessment reporting to management in identifying and developing these measures. a way that places more emphasis on the higher and emerging risk areas. This is particularly true for areas of higher residual Three Audit Applications risks. When Lean management is new to an organization, Internal audit can incorporate Lean principles into its risk the report also can serve as an educational tool by including a assessment, evaluate the effectiveness of the organization's description of Lean management and its implications. During Lean processes, and emphasize high and emerging risks in its the transition to the Lean risk assessment, internal audit may audit reports. neod to include a summary of the reasons for the change and the significant changes in the report that result from it. Risk Assessment Internal audit should incorporate Lean processing principles and practices in its risk assessment and Commitment to Improvement other work. One key practice is to continuously provide If the organization has adapted Lean management, it is imper- what management wants and needs. Management, then, ative that the internal audit function do so, as well. Even if must be directly and extensively involved in planning the risk the organization has not enacted Lean management practices, assessment and identifying its needs. When internal audit internal audit can implement Lean concepts to show its respect has identified significant risk areas that management has not for people and continuous improvement. By doing so, auditors identified, it should share this with management and, if nec- can promote adoption throughout the organization. E essary, educate management about the nature and magnitude of the risks, the means and metrics to measure those risks, BRIAN B. ALLEN, CIA, CPA, CRMA, CITP, is corporate controller the importance of including them in the risk assessment, and with Living Water International in Stafford, Texas. LEAN RISK ASSESSMENTS Emphasizing management's needs and continuous improvement can enhance can management and includes identifying and this aspect of Lean manage- internal audit's risk production practices eliminating processes and ment, the emphasis is on are modeled after the assessments. costs that do not add value to customer satisfaction-spe- Toyota Production customers. In the case of the cifically the value added to System, which focuses on risk assessment, the key cus the customer, referred to two axioms respect for peo- tomer is management. Con as value stream manage- ple and continuous improve tinuous improvement refers ment. This process involves ment. Respect for people more to creating and main- concentrating on what the includes respect for the needs taining systems and processes customer wants as expressed of employees, the environ for continuous improvement, by what he or she is willing ment, customers, strategic not just creating incremental to pay for Customer consid- partners, and host communi- improvements. In Lean pro- erations include features, ser ties. Continuous improve cessing, improvements are vices, and quality, as well as ment refers to continuously driven by employee involve- the time between customer enhancing processes, particu- ment and include a drive demand and delivery (cycle larly as they are driven by toward zero defects. time). For some customers employees throughout the One example of the fun- this also will include respect organization. As more orga- damental changes that take for the environment. These nizations move toward Lean place is how product inven two changes, coupled with practices, internal audit must tory is thought of, planned other changes in the cost and be involved, especially in for, and managed. Tradition- pricing structures and finan- how the organizational risk ally, inventory is considered cial management parties assessment is performed an asset, partly because of in Lean management, have a and communicated the high costs of set-up in significant effect on the way the production process. In the risk assessment needs to What is Lean Processing? Lean processing, set-up costs be conducted and reported. Lean management moves are greatly, if not entirely away from the traditional reduced through process Assessing Risk emphasis on revenue gen- improvement and inventory As the organization makes eration and profitability to is considered to be waste. changes to adopt Lean concentrate on the customer Another big change is management practices value stream through con- the transition from target the internal audit function tinuous improvements. This pricing to target costing. In must change to increase the department's service levels and value to the organization. In the means to mitigate them. Internal audit also may need its risk assessment, internal audit must determine the risks to to explain why typical risks that were previously included in the organization associated with this new paradigm: how to the assessment have been moved off the grid because of the measure, quantify, and mitigate them. Although these changes changes Lean management has brought about. After com- vary among organizations, internal audit must consider the pleting the risk assessment, internal audit should survey man- opportunity cost of not continually improving, and thus fall- agement to determine its effectiveness and how the process ing behind the organization's competitors and becoming irrel- and report can be improved the following year. evant to its customer base. Because employees are fundamental Another key practice is to continuously improve internal to the process, there must be a measure of their engagement. audit processes. Because staff participation is a key factor in Benchmarking also is needed to measure improvements in this process, auditors should always seek and share ways of improving the process and the report. Internal audit also should include The risk assessment should evaluate benchmarking to keep up with best practices in the profession. This should the effectiveness of Lean processes. include an annual review of technology updates and advances such as analytics software. Auditors also should review the cost structure internally and with competitors. Internal how internal audit can benefit from emerging technology audit can provide input to management as it seeks to define, such as social media, particularly the use of social media as a develop, and collect data on these measures. business strategy. Internal audit should never accept the sta- The other major area of concern is respect for various tus quo in its processes. stakeholders and the environment, which should be a con- cern and benefit to all stakeholders. These interests typically Organizational Processes Internal audit should develop don't have a "voice" in risk deliberations, making them easier risk assessment procedures that evaluate the state and effec- to overlook. As such, they may be the most difficult areas in tiveness of the Lean processes within the organization. While which internal audit must adapt its risk assessment. When this is a typical procedure during the risk assessment, internal internal audit is measuring risks to revenue generation and audit will need to adapt the procedures to the new risk areas profitability, the measures are more straightforward because identified in Lean management. they generally are more objective, numeric values. Measuring respect is more subjective. Internal audit can make a major Risk Reporting To add value to its reporting, internal audit contribution to the process by assisting, or even leading, in should adapt the risk assessment reporting to management in identifying and developing these measures. a way that places more emphasis on the higher and emerging risk areas. This is particularly true for areas of higher residual Three Audit Applications risks. When Lean management is new to an organization, Internal audit can incorporate Lean principles into its risk the report also can serve as an educational tool by including a assessment, evaluate the effectiveness of the organization's description of Lean management and its implications. During Lean processes, and emphasize high and emerging risks in its the transition to the Lean risk assessment, internal audit may audit reports. neod to include a summary of the reasons for the change and the significant changes in the report that result from it. Risk Assessment Internal audit should incorporate Lean processing principles and practices in its risk assessment and Commitment to Improvement other work. One key practice is to continuously provide If the organization has adapted Lean management, it is imper- what management wants and needs. Management, then, ative that the internal audit function do so, as well. Even if must be directly and extensively involved in planning the risk the organization has not enacted Lean management practices, assessment and identifying its needs. When internal audit internal audit can implement Lean concepts to show its respect has identified significant risk areas that management has not for people and continuous improvement. By doing so, auditors identified, it should share this with management and, if nec- can promote adoption throughout the organization. E essary, educate management about the nature and magnitude of the risks, the means and metrics to measure those risks, BRIAN B. ALLEN, CIA, CPA, CRMA, CITP, is corporate controller the importance of including them in the risk assessment, and with Living Water International in Stafford, Texas