Process Mining in der Revision: Ein Erfahrungsbericht

Lenz, R., Druckenmueller, J. & Nominacher, B. (2018): Process Mining in der Revision: Ein Erfahrungsbericht, Zeitschrift Interne Revision (ZIR), 4.18, 202-203

Lenz, Druckenmüller & Nominacher, ZIR_04.18_202-203

Advertisements

Process Mining in der Revision: Ein Erfahrungsbericht

[Info] Dieser Diskussionsbeitrag wird im August 2018 veröffentlicht:

Lenz, R., Druckenmueller, J. & Nominacher, B. (2018): Process Mining in der Revision: Ein Erfahrungsbericht, Zeitschrift Interne Revision (ZIR), August

 

Zusammenfassung:

Die Interne Revision sieht sich heute mit einem grundlegenden Wandel konfrontiert. Aufgrund der fortschreitenden Digitalisierung verändert sich die Unternehmenswelt zunehmend – und mit ihr die Themen und die Praxis der Revisionsprüfung. Berufsständische Vorgaben empfehlen die Anwendung von Big-Data-Analytics. Villeroy & Boch nutzt Process Mining, um eigene Geschäftsprozesse zu optimieren.

Revisionsabteilungen im Wandel

Objektiv, transparent, effizient – Process Mining in der internen Revision

Process Mining bei Villeroy & Boch

Die Interne Revision kann Pionier bei der Nutzung von Process Mining sein

Die Daten sprechen lassen

 

Autorenangaben

Dr. Rainer Lenz ist Leiter der Konzernrevision bei Villeroy & Boch

Jens Druckenmüller ist Manager in der Konzernrevision bei Villeroy & Boch

Bastian Nominacher ist Mitgründer und Co-CEO von Celonis

Möglichkeiten und Grenzen des Three-Lines-of-Defense-Model – Es ist Zeit für einen Paradigmenwechsel.

 

Möglichkeiten und Grenzen des Three-Lines-of-Defense-Model – Es ist Zeit für einen Paradigmenwechsel.

 

• 3LOD-Modell ist das gegenwärtige Paradigma
• „Man muß die Dinge so einfach wie möglich machen. Aber nicht einfacher.“ (Albert Einstein)
• Defensive und Offensive
• Silodenken vs. Zusammenarbeit (Aligned / Integrated Assurance)
• Faktor Mensch (Turf Protection)

 

Das “Three-Lines-of-Defense” Modell ist das gegenwärtig vorherrschende Paradigma im Kontext von „Effective Risk Management and Control”. Insbesondere in Zeiten gekennzeichnet von rasanten, disruptiven Veränderungen, man spricht auch von VUCA (volatile, uncertain, complex, ambiguous), erscheint das Modell immer mehr als eine zu grobe Vereinfachung und weist in die Irre. Albert Einsteins Bonmot, „Man muss die Dinge so einfach wie möglich machen. Aber nicht einfacher“, trifft hier ins Schwarze. Das Modell hat lediglich die Defensive im Titel und zum Inhalt. Die Offensive kommt überhaupt nicht vor. Ein Designfehler. Die Offensive gewinnt Spiele, die Defensive gewinnt Meisterschaften, heißt es zurecht. Beides gehört zusammen. Risiko hat zwei Seiten. Im modernen Fußball sind Spieler offensiv, wenn die eigene Mannschaft den Ball hat, und defensiv, wenn der Gegner den Ball hat. Was bedeutet das für Organisationen? Das aktuelle Paradigma fördert Silodenken statt Zusammenarbeit und ignoriert den Faktor Mensch. Es ist Zeit für einen Paradigmenwechsel.

 

 

 

What does Independence as an Internal Auditor really mean?

Link to the article published in CiA based on my input

Published: 12 Feb 2018 | Careers in Audit

The IIA definition positions internal auditing as an “independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.” According to Rainer Lenz, Head of Corporate Audit at Villeroy & Boch, independence in internal audit is perhaps one of those ideas that works better in theory than in practice; it poses a challenge in its expectation of the internal auditor to be both “watchdog and consultant”.

Lenz draws attention to what commentators often refer to as the internal auditor’s ‘role dilemma’ and ‘role confusion’, noting the difficulties of internal auditors in striking a balance between being independent from operations while at the same time providing added value and benefit to operations. “Some view internal audit as a schizophrenic function,” he says; “on the one hand it needs to be completely integrated and knowledgeable and on the other hand, it requires a measure of independence from all auditors.” As a result, Lenz ascribes “a built-in cognitive disconnect” to the very purpose of internal audit.

Acknowledging this fundamental inconsistency in the very nature of internal audit within the wider business sphere, which indicates that those at the head of the business food chain are somewhat frustrated with internal audit’s inability to properly define its own role; Lenz notes “there is no congruence between what the board wants, what the audit committee wants and what senior management wants.” Thus internal audit are forever faced with the impossible task of pleasing everybody with no real sense of who to please first, particularly when each party expects something different. Lenz refers again to the IIA, who acknowledge that there may be conflicts when internal audit tries to “serve two masters” and understandably this “who’s your boss?” issue can present problems in terms of allegiances, independence, and effectiveness.

This in turn raises the need for filtering independence from the head down, with most CEOs advocating a free speech approach with their Chief Audit Executives (CAEs) enabling them to work under the understanding that he or she should feel free to voice their opinion, regardless of potentially controversial scenarios. This, Lenz notes, “draws particular attention to the importance of the CAE’s characteristics, which is possibly more important than the debate around the general independence of internal audit.”

One could argue that for internal auditors to do their jobs successfully, this requires full independence from senior management in order that the board is able to rely on their internal audit department for the necessary assurance in relation to internal controls, risk prevention and so on. “Otherwise,” says Lenz, “the risk is that internal audit’s reports to the board and audit committee will be filtered by senior management in such a way that only what is palatable to senior management is communicated.”

If internal audit is to retain its necessary independence in practice, it must take the time to invest in its relationships with the board, audit committee, key business stakeholders and senior management, sustaining a steady and robust dialogue with each party in order to perpetuate its own functional success.

 

INDEPENDENCE is a challenging concept for internal auditors

 

Recently, I was invited to share some thoughts about independence of internal auditors. I am basically challenging that concept …

The IIA definition positions internal auditing as an “independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.”

To be blunt, in my view, independence is largely theory. It is overrated, I think. So is objectivity. But let’s stay with the subject matter of independence. There is nothing wrong with aspiring independence. But, who cuts the hand feeding him? There are inconsistencies among talk and action. Consequently, academic authors refer to the internal auditor’s “role dilemma” and “role confusion”, acknowledging for example the difficulties of internal auditors to strike the balance between being independent from operations and, at the same time, providing added value and benefit to operations. Being both watchdog and consultant is challenging.

Some authors view internal audit as a schizophrenic management function. On one hand, it needs to be completely integrated and knowledgeable. On the other hand, it needs a measure of independence required of all auditors. Thus, internal audit may have a built in cognitive disconnect. Organizations and Chief Audit Executives (CAEs) may cope at different levels of proficiency with such inconsistent demands. Those who can do that well may live longer. Thus, “organizational hypocrisy” may serve a useful purpose.

When you ask non-executive directors and audit committee chairmen what they think, how independent internal auditors are, what will they say? I recall surveys where those members of oversight bodies state that (some) heads of internal audit are not up to the job, internal audit lacks adequate independence, and internal audit has not properly defined the role that they wish internal audit to fulfill.

That points to the “who’s your boss” question. There is no congruence between what the board wants, what the audit committee wants, and what senior management wants. Aiming at satisfying all customer groups is likely to disappoint one or the other customer in some dimension, as all may expect something different from internal audit, such that no one is fully satisfied. In other words, internal audit may face tension from its attempt to serve – let’s say – its two prime customers: managers and the audit committee. The IIA acknowledges that there may be conflicts when internal audit tries to “serve two masters”. Thus, the “who’s your boss?” issue can present problems in terms of allegiances, independence, and effectiveness.

Academic studies confirm that role ambiguity and role conflict can negatively affect the independence of internal auditors. At the same time, CEOs (often) want the CAE to have no fear or favor. It is crucial that the CAE is able to work with other stakeholders in the organization and is not afraid to voice his or her opinion even in controversial situations. That draws particular attention to the importance of the CAE’s characteristics, possibly more important than the debate around independence.

There are authors who suggest that internal auditors must be independent of senior management, so that the board is to rely on internal audit to provide the assurance it needs; otherwise, the risk is that internal audit’s reports to the board/audit committee will be filtered by senior management in such a way that only what is palatable to senior management is communicated. Investing in these relationships and having a steady and robust dialogue is critical to the internal audit function’s success, given its organizational context.

My 2 cents about independence of internal auditors in a nutshell.

What is your perspective? Interested in your views.

 

Source: Lenz, R. (2016), Insights into the effectiveness of internal audit: a multi-method and multi-perspective study, LAP LAMBERT Academic Publishing, Saarbrücken, ISBN 978-3-659-85241-1, http://goo.gl/uw2pNz

Please see also: Careers in Audit, 12 Feb. 2018

 

 

 

Most read paper 2017 – Thank you !

Lenz, R. and Hahn, U. (2015), A synthesis of empirical internal audit effectiveness literature pointing to new research opportunities, Managerial Auditing Journal, Vol. 30 No. 1, 5-33

http://www.emeraldinsight.com/doi/pdfplus/10.1108/MAJ-08-2014-107

50 free online copies

Lenz, R. (2017), Time is Ripe to Revolutionalize the Audit, EDPACS, 56:4, 19-22

50 free online copies <download>

Access to paper @EDPACS

 

Abstract

There have been doubts around the added value and relevance of (internal) audit. There have been question marks whether that profession truly focuses on what matters most. How can we make better? How can we make (internal) audit an even greater success in the eyes of its customers and stakeholders, too? In the digital age, more than ever, there is nothing as constant as change. It is time to revolutionize the audit. Process Mining has the potential to revolutionize (internal) audit. Let your data speak to drive learning and change.