August 1999

THE CPA IN INDUSTRY

THE INTERNAL AUDIT AND ACTIVITY BASED MANAGEMENT

By Jonathan S. Forrest and
Edward Forrest

The internal audit department is one of the most underutilized assets in most companies. Usually the audit function is limited to the identification and communication of routine difficulties and is not viewed as a value-added problem solving unit.

Successful corporations have realized that limiting the internal audit department's responsibilities to financial reporting and meeting statutory regulations is an outmoded approach. These organizations have enlarged their focus to include operational audits, consulting, and process improvement initiatives as a means of adding value to the function.

A further extension of the internal audit function that has yet to be fully utilized is activity based management (ABM). This methodology provides the internal auditor with the ability to identify and eliminate activities that do not contribute economic value to a business.

Advantages of ABM

ABM gives the internal audit function the ability to redesign an organization's processes and systems while building in the necessary internal controls. This coupling with ABM assists internal auditors in uncovering financial and operational problems before they can do damage.

ABM affords internal auditors the opportunity to be in a better position to detect potential fraud through early detection of out-of-bounds situations from an operational dimension. For example, studies have shown that employees that steal are usually in a position of trust which allows them to seize opportunities or take advantage of control weaknesses.

ABM sheds new light on operational activities and exposes process weaknesses that lack controls. The internal auditor is exposed to how work is currently performed and is able to recommend how work should be performed.

There is an interesting difference between small business owners and major corporate executives. The small business owner has an instinct about what looks right and what doesn't. A well-structured ABM program gives the internal auditor of a large corporation the instincts of a small business owner to see and feel the important operating issues.

Making the Transition

Making the transition is not easy for internal auditors because their primary training centers on financial controls. Organizations that wish to incorporate ABM techniques may find that their staff is not trained for it.

Bringing ABM to the internal audit function requires a change to the internal audit charter and mission statement. As part of the new charter, revised reporting lines, communication lines, and work practices must be created to accommodate ABM.

There are potential conflicts of interest between internal auditors and senior management. Can an internal auditor maintain the independence required to effectively perform her fiduciary responsibilities? An audit by its very nature involves asking probing questions, making unannounced visits, and challenging executive decisions and judgments. Internal auditors can be objective, independent partners with the
operating business units without having an adversarial relationship. When ABM is part of the internal audit process, an executive can be assured that a positive benefit will be derived from the audit process.

Application of ABM

The latest management techniques have resulted in flatter organizational structures, the elimination of hierarchies, and fewer internal controls. Managers have taken on a new role as facilitators and coaches instead of supervisors. The old, rigid hierarchical structures have little place in the process improvement world.

With fewer controls, senior management's new organizational structures need to be revisited. The internal audit group is the logical choice to complete the review and, armed with ABM techniques, will be able to successfully establish the required checks and balances.

Advocates of process improvement cannot be allowed to arbitrarily dismiss the concept of extensive checks and controls. ABM methodology champions audit trails, clear activity definitions, appropriate separation of duties, and well-defined performance measures.

The internal auditor will not allow one person to possess the combined custody, control, and authorization responsibilities for an activity, because this increases the risk of concealment or misappropriation of assets. However, the internal auditor must be somewhat flexible so that controls do not become cost-prohibitive.

New types of controls are required that take the form of information sharing and trust instead of internal controls inherently based on mistrust. Enhancement of the internal audit function with ABM methodology in the information age provides organizations with a distinct advantage. *

Jonathan S. Forrest is vice president and Edward Forrest is president of Productivity Consulting, Ltd., in Roslyn, N.Y.

Editor:
James L. Craig, Jr., CPA
The CPA Journal

The CPA Journal is broadly recognized as an outstanding, technical-refereed publication aimed at public practitioners, management, educators, and other accounting professionals. It is edited by CPAs for CPAs. Our goal is to provide CPAs and other accounting professionals with the information and news to enable them to be successful accountants, managers, and executives in today's practice environments.