Chapter 6 TOOLS

Tools

- they provide diverse means of gathering information, analyzing it, presenting it, and
serving as tools to persuade our clients that either conditions are satisfactory or that
they need corrective actions

Quality Assurance

- provides methodologies and tools to prevent mistakes or defects in products and

services.
- helps to avoid problems and can help auditors give management and the board
reasonable assurance that activities will be performed as expected, requirements will
be met, and resources will be used responsibly

Histogram

- charts that show the frequency distribution of numerical data using rectangles, each
of which represents intervals
- X-axis represents a dimension arranged over equal intervals
- Y-axis represents the quantity, frequency, or other metric being plotted against the
interval
- used for continuous data

Control Chart

- a graph used to plot and study how a process changes over time
- has a central line for the average or target value for the process being plotted, an
upper line for the upper control limit and a lower line for the lower control limit.
- one of the seven basic tools of quality
- it is seldom known, and even less frequently used, by internal auditors

Pareto Chart

- also known as the 80/20 rule

- posits that for many events approximately 80% of the effects are caused by 20% of
the causes
- designed to organize data and can be used to prioritize improvement effort by
focusing on major root causes of the problems under review

Cause and Effect (Fishbone, Ishikawa) Diagram

- Kaoru Ishikawa
- help identify contributing causes of an issue, and hone into the root cause most
accurately
6M for finding the root cause of issues:
1. People. Individuals involved in the process.
2. Methods. How the process is performed and the requirements for doing it. This may
include policies, procedures, regulations, laws, and rules.
3. Machines. Any piece of machinery, computers, tools, or equipment required to
perform the work.
4. Materials. Inputs used to produce the product. This may include raw materials, parts,
semi-finished goods, and paper.
5. Measurements. Data used to evaluate the quality of the process.
6. Environment. Conditions in which the process or activities are performed. This may
include time, location, temperature, humidity, noise, and culture.

Force Field Analysis

- great decision-making tool to identify the forces for and against a course of action
- a technique to list, discuss, and evaluate the forces that support or hinder a decision
- can also help to strategize the best way to present the information by understanding
the big picture and the pros and cons of the recommendation
- it forces the proposal advocate to “walk a mile in the auditees’ shoes.”
- useful to resolve conflict of opinions, comparing pros and cons of a decision and to
evaluate the strength and weaknesses of an idea, product, or project

Flowchart/Process Flow Map/Value Stream Map

- sometimes also called process flow diagram, process map, process model, and work
flow diagram
- a diagram that represents a workflow or process
- shows the steps in the form of boxes of different shapes and the order or sequence
of events by connecting the items with arrows
- used to design, document, manage, and analyze a program or process in virtually
any field by presenting the process flow in visual form

Cross-functional Flowchart

- often called a flowchart with swimming lanes

- shows the steps in the process, but also the units or individuals performing the
activities
Hand-off – when transactions are passed from one actor to another to continue
the process

Most common symbols in flowcharts

o Rectangular boxes: They show a processing step or activity
 o Diamonds: Represent a decision
o Arrows: Show direction of the flow of each activity
o Ellipses: Indicate the start and stop of the diagram

As Is map

- a great source of information to understand the process being reviewed, but

also to establish a baseline for performance
- essential for the auditor to understand the current process and what is
working or not working

To-Be diagram

- show the future state or desired condition

Common Process Improvement Areas

1. Backlogs – these represent an accumulation of work, often in the form of
uncompleted work that needs to be done

2. Cycle time - the total time from the start to the end of a process

Components of Cycle Time

o Stop watch
o Systems data
o Sample

Tak Time

- the rate at which the production operation produces output

- derived from the German word “takzeit” that translates to “rhythm”
- , it relates to the amount of time to perform each activity
 - the rhythm or heartbeat of the operation and it is the pace at which everyone in
the process works to keep capacity aligned
- used to determine the pace to keep a process flowing, so there are no
bottlenecks in a process

Lead time – refers to the time from the initiation to the completion of a process

Eight Areas of Waste

1. Transporting
2. Unnecessary inventory
3. Excess motion
4. Waiting
5. Unnecessary processing or paperwork
6. Defects
o Physical causes
o Human causes
o Organizational causes
7. Overproduction
8. Underutilized employees

Waste reduction is imperative to increase profitability and better utilize the limited resources
that most organizations operate with.
Waste occurs when more resources are consumed than necessary to produce the goods or
services the customer actually wants.

Affinity Diagram/KJ Analysis

- also called affinity charts or the Jiro Kawakita (KJ) method

- very useful tools that can help auditors organize ideas and large amounts of data
- require the following materials: sticky notes or cards and a large work surface to
work on
- work best when the team is small and you want to highlight similarities in ideas to
build consensus and organize ideas or items into categories or themes

Check Sheet

- common tool widely used by internal auditors, but seldom called by that name
- a structured form or document used to collect and analyze data
 - used when the data are observed and collected repeatedly and the intent is to
document the frequency or pattern of problems, defects, defect causes, or events

Scatter Diagram

- a visual tool for analyzing pairs of numerical data and showing the relationship
between two variables
- sometimes called a scatter plot or an X–Y graph, with one variable on each axis

Two elements of the relationship

1. Direction
- If the two variables increase in tandem, there is a positive correlation
between the two. This means that as one variable increases, the other
variable increases as well. On the other hand, if one variable
increases, while the other decreases, there is a negative, or inverse
relationship between them

2. Intensity
- how strong the relationship is or the correlation coefficient

5S

- the name of a workplace method that uses a list of five Japanese words to
describe how to clear, organize, and maintain the workspace for efficiency and
effectiveness by identifying, storing, and maintaining the items used, maintaining
the physical space and items, and sustaining the arrangement

1. Seiton
- “systematic arrangement,” “set in order,” “straighten” or “streamline,”
- calls for workers to arrange all necessary items, so they can be easily found and
selected for use
- generally relates to neatness and suggests that by maintaining the work
environment tidily and in order

2. Seiri
- “sort.”
- calls for workers to remove unnecessary items and dispose of them appropriately
 - makes the work easier to be performed by eliminating obstacles, reducing the
likelihood of being disturbed with unnecessary items and it also prevents the
accumulation of unnecessary items
- related to organization and encourages optimizing the arrangement of parts and
materials so that this better design will improve workplace efficiency

3. Seiso
- to “shine,” “sweep,” “sanitize,” or “scrub.”
- admonishes cleaning the workplace completely and keeping it so
- related to cleaning, and in many work environments

4. Seiketsu
- to “standardizing” the best design and operating practices in the work area
- to maintain high standards of workplace organization and housekeeping at all
times

5. Shitsuke
- “sustain.”
- to keep in working order and “do without being told.”

RACI Diagram

- responsible, accountable, consulted, informed

- also referred to as responsibility assignment matrix, and linear responsibility chart
- describes the participation by various roles in completing tasks or deliverables
and it is especially useful in clarifying roles and responsibilities in cross-functional
or departmental projects and processes because it identifies who does what.

Responsible: Who does this?

Accountable (Also Approver): Who approves the activity after it is completed?
Consulted: Who will assist the people responsible?
Informed: Who should be kept up to date about the activities?

Communications Plan

- useful to make sure communications within and outside the team are effective
- identifies the key elements to make sure the intended message is received,
understood, and acted upon by the main stakeholders during the engagement

Six Questions
What: what will be included in the communications
When: the timing of the communication activities
 Where: the location of the communications
Who: who should attend the meetings
How:
Why:
Communications Matrix

- used to summarize and facilitate the communication plan by defining the details
regarding the communications activities that are used during the team or
department’s activities during the course of the project

Key Elements
o communication type
o description
o delivery method
o frequency
o documents
o participants

Suppliers, Inputs, Process, Outputs, and Customers Map (SIPOC)

- an acronym that stands for suppliers, inputs, process, outputs, and customers
- particularly useful when defining the scope of the review because it can give
auditors a high-level overview of the program or process

Poka Yoke/Mistake Proofing

- term used to describe a mechanism in a process that helps operators avoid

mistakes
- a Japanese term that means “mistake-proofing”
- to eliminate defects in products by preventing or drawing attention to human
errors that can occur
- tool for internal auditors who are often called upon to examine the design of
programs and processes, and make recommendations for improvement

Common Ways of Mistake-proofing

Orientation Part won’t fit incorrectly
Sequence Process has predetermined
sequence
Weights
Location
System Check
Benchmarking

- the process of comparing statistical information

- consists of comparing at least one performance metric to a standard, or multiple
performance metrics to each other
 Metrics used:
o Time
o Quality
o Cost

Five Whys

- useful to identify the root cause of issues

- simplest tools for RCA

Work Breakdown Structure

- a “deliverable-oriented grouping of project elements that organizes and defines

the work scope of the project

Chapter 7 Eight Areas of Waste

Waste
 - anything done or acquired that is not required to successfully complete an activity
or support a process
- loss of something valuable that occurs because too much of it is being used or
because it is being used in a way that is not necessary or effective

The Eight Areas of Waste Model provides a simple methodology to identify actions and
items that reduce the value obtained from available resources.

Highlights the importance of:

1. Proper planning
2. Proper execution

Effective performance is a continuous process that begins with the design of the process
and the visioning required to plan for and anticipate the products or services to be delivered

Three words popularized by Toyota in The Toyota Production System (TPS) and The Toyota
Way
1. Overburden (muri)
2. Inconsistency (mura)
3. Eliminate Waste (muda)

Overproduction

- the production of a given output in excess of what is required

Batch Production

- a common practice, often embraced as a best practice to take advantage of

economies of scale

Economies of Scale

- the cost advantage obtained with the increased out-put of a product

Waiting

- the delayed action that happens until some other productive action is done on the
item produced
- usually nonvalue added, as the goods await further action at a subsequent time
- occurs because there is a lack of coordination and timing between
complementary activities within an organization or a process.
Speed has become a key differentiator among competing organizations.

Transporting

- the action of moving an item from one location to another

- eliminating transportation waste requires a focus on the flow of materials,
machines, and people

Unnecessary Paperwork or Processing

- we should aim for a work environment where the use of paper is eliminated or
greatly reduced
- done by converting documents into digital form to save money by reducing the
amount of paper and ink used, increase productivity, save space, and make
documentation and information sharing easier

Unnecessary Inventory

- excess products, materials, parts, and documentation not being processed

immediately, or ahead of requirements
- if the items are never needed, damaged, or lost/stolen, they must be written off
as excess and obsolete (E&O), only compounding the problem

Excess Motion

- waste of movement can occur because people or equipment is operating in a

poorly designed work environment
- common technique to show how damaging excess motion can be is spaghetti
mapping

Spaghetti Map

- aka spaghetti chart or spaghetti diagram, is a method of viewing data to visualize

the flows through systems
- effective tool to track routing
- through factories and other types of workplace to identify inefficiency within the
flow of the system

Defects
 - a physical problem that causes something to be less valuable, effective, healthy,
etc., something that causes weakness or failure and an imperfection that impairs
worth or utility
- prompt the need to rework the item to correct the error made
- caused by machine wear, human error
- due to lack of training, unclear specifications, or by more troublesome causes
such as tampering or broken machines due to neglect or conflicting priorities
- related to the physical attributes of the product, and that is a reasonable
assessment. But defects can be qualitative as well
Quality is a key differentiator among competing organizations

Underutilized Employees

- employees should be given every opportunity to work in, and get promoted to, the
position where they can use their skills and talents to their full potential

Identifying, Assessing, and Preventing the Occurrence of Muda

- internal auditing cycle begins with the identification of the auditable universe in
the organization
- this audit universe consists of all auditable entities, accounts, programs,
processes, and systems relevant to the organization

Quality Assurance (QA)

- focuses on the ability of a process to produce or deliver a quality product or

service
- attempts to prevent issues by identifying anomalies and improving a process until
it can produce a quality deliverable
- This approach is strategic
- During production

Quality Control

- designed to detect problems with a product or service through inspections

- It is tactical and adds value by identifying problems before they get to the
customers
- After production

QA ensures that there will be quality during production while QC controls the
execution to make sure that there was quality. One is future oriented and
prospective. The other focuses on the past and is retrospective.
Chapter 8 Quality Control
Three main categories related to transactions, balances, and presentation assertions.
1. Transactions and events – relate to the income statement

o Occurrence: The business transactions recorded actually took place.

o Completeness: All business events and their related transactions that should
have been recorded were recorded.
o Accuracy: The transactions were recorded in the corresponding ledgers at their
full amounts without errors.
o Cutoff: The transactions were recorded in the appropriate accounting period;
neither early nor late.
o Classification: The transactions were recorded in the appropriate general
ledger accounts.

2. Accounts balances – relate to the balance sheet

o Existence: Assets, liabilities, and equity balances exist as shown.

o Rights and Obligations: The organization has rights to the assets it owns and is
obligated as indicated in the outstanding liabilities reported.
o Completeness: All reported asset, liability, and equity balances that should
have been recorded were recorded.
o Valuation: Asset, liability, and equity balances are valued and recorded at the
proper valuation, and all adjustments were recorded appropriately.

3. Presentation and Disclosure – relate to the disclosures that accompany to FS

o Occurrence: The reported transactions and disclosures occurred.

o Rights and Obligations: The transactions and disclosures are related to the
organization.
o Completeness: All disclosures that should be disclosed were disclosed in the
financial statements.
o Classification and Understandability: Financial statements are clear,
understandable, and present all necessary information appropriately.
o Accuracy and valuation: All relevant information is disclosed at the appropriate
amounts and reflect the proper value
Economy: The program or process obtains resources at the optimal value to the organization
Efficiency: The program or process operates in such a way that it achieves maximum
productivity with the lowest possible wasted effort, expense, or time
Effectiveness: The program or process achieves or exceeds its objectives.
Ethics: The operation acts in accordance with acceptable moral principles that govern the
organization’s behavior
Equity: The program or operation acts in ways consistent with expectations of equality, and
fairness when dealing with individuals or other organizations
Ecology: The operation’s activities protect and promote protection of the natural
environment.
The 3Rs to improve organizational stewardship
o Reduce
o Reuse
o Recycle

Excellence: The program and related activities adhere to the highest possible degree of
quality and seeks near-zero error rates as much as reasonably possible

Operational objectives (we don’t refer to them as assertions, since that term is reserved for
financial statements) are made with a broader, more balanced viewpoint: retrospectively as
relates to past activities to report on past practices, and prospectively, related to the future
implications of these practices

The Link between Process Weaknesses and Internal Control

COSO states that “internal control is a process effected by an entity’s board of directors,
management, and other personnel, designed to provide reasonable assurance regarding the
achievement of objectives relating to operations, reporting, and compliance.”*

Six Sigma and Lean Six Sigma

-
- a process improvement methodology designed to make sure that a process will
deliver its output within a prescribed tolerance range
- a business and process improvement methodology used to improve processes
by using statistical analysis to identify the sources of error and determine the best
way to eliminate them
- a collection of management tools and methodologies to reduce variation, errors,
and increase the speed of execution, while focusing on eliminating mistakes,
rework, and waste

KEY OBJECTIVE: minimizing variability

In general, the DMAIC methodology is used for existing processes, while DMADV (DFSS) is
used when building a new or highly modified process or product.

ISO 9000 and ISO 31000

 The ISO 9000 family of standards address various aspects of quality management
 ISO provides a great deal of guidance on almost all aspects of technology and
manufacturing.

 ISO 9001:2015—It sets the requirements of a quality management system

 ISO 9000:2015—Addresses the fundamental concepts and language
 ISO 9004:2009—Focuses on how to make a quality management system more
efficient and effective
 ISO 19011:2011—Provides guidance on internal and external audits of quality
management systems

Customer focus: The primary objective of any organizational activity should be to meet
or exceed customer requirements and expectations
Leadership: Leaders align the organization’s strategies with the organizational structure,
establish policies, build processes, and assign resources effectively to achieve its
mission.
Engagement of people: Knowledgeable, engaged, and empowered workers are
essential for the creation and delivery of value to stakeholders.
Process approach: When activities are designed, understood, and managed as part of
a coherent integrated system, it is more likely that the organization will achieve
consistent, predictable results.
Improvement: Organizations must constantly examine how they are structured and
operating, identify, and react promptly and effectively to both internal and external
change
Evidence-based decision-making: Desired results are more likely to be achieved when
decisions are data driven and based on the careful analysis of information.
 Relationship management: For long-term success, organizations must manage their
relationships with their stakeholders, especially suppliers.

Using ISO 9001:2015 helps ensure that customers get consistent, good-quality products
and services, which are an area of focus for internal auditors as well.

ISO Quality Management Principles

- provide a useful baseline to examine the structure, conditions, and practices

within the designated scope area to determine if the criteria are sound and if the
practices are conducive to successfully meeting the expectations of the
organization’s stakeholders

Chapter 9 Documenting Issues

Finding

- the discrepancy between what is expected and what is actually in place, as

discovered by auditors during the course of their work
- provides the details about the anomaly and is determined as a result of the
procedures performed by the auditor

Criteria

- the performance standards or expectations set by relevant stakeholders

- used in making the evaluation or verification, and consist of the expected
performance
- consist of what should exist—the correct state

Condition

- refers to what the auditor discovered as a result of applying auditing procedures

- the factual evidence that the internal auditor found during the review
 - it is the current state

Cause

- the reason the condition exists

- explains why there is a difference between expected and actual conditions

Some of the tools suited to help auditors get to the root cause of problems
o 5 Whys. Ask “why?” until you get to the root cause of the issue
o Cause and effect diagram (also known as fishbone diagram). Create a
diagram to show visually all the possible factors creating the issue to see where
the problem may have started.
o Drill down. Break down the condition into smaller parts to gain a better
understanding of the larger picture. This could also involve data analytics

Effect

- constitutes the consequence of the condition identified

- relates to the risk or exposure the organization, program, process, or others will
face because the condition is not consistent with the criteria
- the impact resulting from the problem itself

Recommendation

- the action, or collection of actions, that if successfully implemented, will neutralize

the cause, stop the effect, and restore the condition to the desirable state

Making Findings and Recommendations Persuasive

Findings and recommendations will be persuasive to the extent that they convince the
reader that there is a real problem that requires correction. This can be achieved through a
number of actions
1. Quantify as much as possible
2. Make sure findings are significant
3. Consider the cost/benefit involved
4. Use appropriate language

Using Quantitative Methods to Improve the Quality and Impact of Audit Findings
o Logos
- persuasion on the basis of fact or reason
- the process is based on the fact that people believe they are logical and
reasonable
 o Ethos
- persuasion can also be achieved by appealing to the character of the presenter
- this approach is based on the character of the presenter, who must be
trustworthy, honest, intelligent, or otherwise credible

o Pathos
- approach based on emotion
- persuasion is based on expressing feelings on a subject, getting an emotional
reaction, or both

Persuasion and Diversion

Auditors should know about some of the techniques used to persuade, distract, and divert
their attention
1. Repetition - perpetrator hopes that the frequent repetition creates legitimacy
2. Will of the majority - representing one’s argument as if it were the will of the majority
3. Generalization - consists of what is commonly stated as “everyone is doing it.”
4. Creating information - attempt to present a different version of the truth
Internal auditors should remember that the evidence should meet certain criteria:
1. Verifiable
- All results should be based on reliable facts, figures, and documents that others
can inspect independently, and by applying the care and judgment of a
reasonable person, arrive at the same conclusion.

2. Transparency
- When there is a legitimate need and authority to do so, the facts, figures, and
documents should be available for review by others

3. Sufficiency
- The facts, figures, and documents used during the review should be enough to
convince an equally qualified, prudent, and unbiased person.

4. Reliability
- The facts, figures, and documents used should be free from tampering, or
significant and unexplainable quality variances, prepared by a suitably qualified
individual or system and provided timely for review and analysis.

5. Relevancy
- The facts, figures, and documents used during the review should be applicable
based on the scope of the review and the objectives of the organization, program,
or process.

6. Usefulness
- The facts, figures, and documents used should help the organization, program, or
process improve its operations, and enhance its ability to achieve its objectives.