In today’s economic environment, governments feel the pressure to operate more efficiently, and many are therefore considering the gradual and continuous process improvement that Lean provides. Lean begins by examining a process from beginning to end, without departmental barriers; identifying the parts of the process that are inefficient; making a case for Lean improvements; and improving the process by reducing activities and waste that don’t add value to the consumer of the process

Lee, Michael T.

Mann, Arti

Raschke, Robyn L.

Boise State University - ScholarWorks

Boise State UniversityScholarWorksAccountancy Faculty Publications andPresentations Department of Accountancy6-1-2013Lean Processes without Compromising ControlsRobyn L. RaschkeUniversity of Nevada, Las VegasMichael T. LeeBoise State UniversityArti MannUniversity of Houston - Clear LakeThis document was originally published by Government Finance Officers Association in Government Finance Review. Copyright restrictions may apply.By ROByN L. RASCHKE, MICHAEL T. LEE, AND ARTI MANNwithout Compromising ControlsLean ProcessesJune 2013 | Government Finance Review  45In today’s economic environment, governments feel the pressure to operate more efficiently, and many are therefore considering the gradual and continu-ous process improvement that Lean provides. Lean begins by examining a process from beginning to end, without departmental barriers; identifying the parts of the process that are inefficient; making a case for Lean improvements; and improving the process by reducing activities and waste that don’t add value to the consumer of the process. For example, a city changed its purchasing process to require a purchase order only for purchases of $500 or more, instead of every purchase. After the change, smaller purchases required only a direct payment request form, which greatly simplified the process while still accounting for the money being spent — it required fewer signatures, less paperwork, and shorter lead times.1 But while this example elimi-nates the costs of waiting and extra processing, it is not clear if the risks of loss — including loss caused by fraud or other intentional and unin-tentional acts — were addressed. Process control considerations may have taken a back seat to the quest for eliminating waste. That doesn’t have to be the case, how-ever; controls can be designed into Lean processes without compromising the effectiveness of Lean initiatives. This article provides guidance on finding the right balance between Lean and control objectives. THE COSO FRAMEWORKThe goal of Lean is to develop processes that are both efficient (i.e., they reduce costs) and effective (i.e., they improve quality). In pursuit of this goal, participants in Lean initiatives look for sources of inefficiency and inef-fectiveness, or waste, such as excess processing, motion, waiting, employees who aren’t used to their full capa-bilities, inventory/backlog, overproduction, transportation, and defects. At the same time, public managers must also:n  Provide reasonable assurance that the objectives and scope of business processes under their responsibility are being achieved.n  Mitigate the risk that the enterprise will be exposed  to some type of harm, danger, or loss.n  Provide reasonable assurance that the organization  is in compliance with applicable legal and regulatory obligations.These are the objectives issued by the Committee of Sponsoring Organizations of the Treadway Commission — known as the COSO — in 1992, and they underlie an inter-nal control framework for organizations.2 Taken together, Lean objectives and the COSO framework provide the right balance of efficiency, effectiveness, and minimal enterprise risk. Five interrelated elements designed to achieve the three objectives of the framework mentioned above are: 1) control environment; 2) risk assessment; 3) control activities; 4) information and communication; and 5) monitor-ing activities. The first three have the most immediate relevance to Lean process improvement.Control Environment. The con-trol environment must be initiated and supported by the managers who will provide the tone for the rest of the department and its relations with other departments. In Lean, manag-ers need make it clear to participants that controls are important, but also that controls should be applied judiciously to maximize the cost-benefit ratio. Managers must then create and support and environment that encourages enlightened thinking about controls over the course of the Lean continuous improvement activities. Risk Assessment. To identify and analyze the likeli-hood and impact of risk factors, organizations that are implementing Lean need to conduct a risk assessment that includes operational risks like fraud, error, downtime, unexplained variances, unreconciled accounts, defects, quality standards, and customer complaints. Exhibit 1 uses traffic light colors to show likelihood and impact. Risks with high impact and risks with both high likelihood and high impact, shown in red, should be mitigated as a first prior-ity. Risks with a high likelihood and low impact, shown in yellow, should be mitigated as a second priority. Risks In Lean, managers need make it clear to participants that controls are important, but also that controls should be applied judiciously to maximize the cost-benefit ratio. 46 Government Finance Review | June 2013in the green quadrant can be addressed if the mitigation tactics don’t compromise process efficiency and effective-ness goals.Control Activities. To mitigate risk control, procedures and policies must ensure:n  Effective Operations. For example, are purchase invoices paid on time, allowing the organization to receive the full benefits of on-time payment?n  Resources Are Employed Efficiently. What is the cost for the people, computer, and other resources needed to make payments on a purchase invoice?n  Resources Are Secure. Are the information resources and funds authorized and available when required to make payment? Are resources protected from loss, destruction, disclosure, copying, sale, or other misuse?n  Input Data Are Approved and Correct. Are all payments support-ed by purchase orders and bills of delivery?n  Input and All Related Documents Are Complete. Are all documents captured in process order and linked to allow for a complete set of documents relating to a payment?n  Input Is Accurate. Are the correct amounts on an invoice payment made to the correct supplier?n  Inputs Are Entered Appropriately. Are the inputs updated completely, accurately, and consistently in the depart-ment’s accounting system?CONTROL STRATEGIES FOR LEANThe COSO framework advises that control activities be built into business processes, but it also states that risk assessment and control activities must not undermine the form and timely processing of information that enables people to do their jobs. The framework also recommends that departments consistently assess the quality of their internal controls and make necessary adjustments that get information to employees in a form and timeframe that enables them to complete their job responsibilities.There are four types of control strategies that can be designed into Lean processes: access controls, authoriza-tion controls, segregation of functions, and application controls. These controls should be evaluated on the risk mitigation cost-benefit ratio for a given likelihood and the risk’s potential impact on the department. Access controls range from physical controls such as locked doors, secu-rity badges, and security guards to security modules on computer systems that identify and authenticate users, grant access to appropriate data and information, and maintain logs of access to reduce the risks of sabotage. Authorization controls ensure that activities, events, or transactions require validations or documents that pro-vide permission. Segregating func-tions dictates that authorization, processing, asset custody, and asset record keeping should be separate to reduce the risks of theft. Application controls such as written approvals, pre-formatted screens, and screens that are populated with key infor-mation reduce the risks of fraud and error.Risk assessment and control activities must not undermine the form and timely processing of information that enables people to do their jobs.Exhibit 1: Prioritizing Risks and ActionsLikelihoodHLL HImpactJune 2013 | Government Finance Review  47These control strategies can be designed into Lean processes rela-tively inexpensively and in a way that mitigates high-likelihood and high-impact risks. The strategies mitigate risk in three ways: prevention, detec-tion, and correction. Each of the controls mentioned above provides risk prevention by closing the oppor-tunity for sabotage, fraud, theft, and error. These controls also detect errors after they have occurred, allowing them to be corrected. When designing a Lean process with control objectives, management needs to assess the types of control that should be implemented based on the process’s risk pro-file, and then consider how a particular control may be used to overcome the risk.To illustrate, the GFOA’s recent whitepaper on Lean recommends that the accounts payable (purchasing) and accounts receivable (sales) processes are good candi-dates for a Lean initiative. Continuing with the purchasing example, we can illustrate how a Lean purchase-to-pay process can be designed to include control objectives. Exhibit 2 shows a swim lane diagram of the participants and activities in a typical purchase-to-pay situation. A visual process map-ping tool using swim lane diagram-ming can provide a level of detail to help determine if the improved Lean process has adequate internal controls. Lean teams start out by conducting an initial assessment of the business process. The teams describe the current situ-ation, discuss gaps and limitations, and develop visions for the future in the form of objectives for the forthcoming Lean-based process. During this time, participants are asked to voice their concerns and provide ideas for process improve-ments by thinking about the sources of waste. The types of concerns that are likely to be raised in the process shown Exhibit 2: A Purchasing to Pay ProcessRecognize NeedSupplier A/P Clerk Buyer Manager EmployeeReceive OrderProcess InvoiceProduce and Mail CheckProcess C/RInvoiceShip ItemsNegociate  and Place OrderApproveRequisitionNegociate and Accept OrderControls can be designed into Lean processes without compromising the effectiveness of Lean initiatives. 48 Government Finance Review | June 2013in Exhibit 2 illustrates might include the following:n  The process involves too many people.n  Repetitive activities in the approv-al and negotiation for every order may be unnecessary and may not add value.n  The process is slow because it isn’t automated.To design a Lean purchase-to-pay process, the department may be tempted to dispense with approval and negotiation activities by mak-ing trade-offs in control. Designing a Lean purchase-to-pay process with control consider-ations would involve automation (reducing the number of people involved, the repetition, and the manual processing issues) and developing guidelines and exceptions around approvals and negotiation. More spe-cifically, the control objectives for the purchase-to-pay process ensure that all transactions are properly authorized, all recorded transactions are valid, all authorized and valid transactions are recorded properly, assets are safeguarded from loss or theft, no employee can commit and conceal an irregularity (segregation of incompatible duties), and all busi-ness process activities are performed efficiently and effectively.Therefore, a Lean initiative would use the above control objectives as a checklist of value-added features. Examining Exhibit 2 makes it easy to determine if there is an autho-rization task as well as adequate segregation of duties (e.g., the same person should not authorize a purchase, Designing Lean business processes with control considerations does not mean “putting up with fat.” Rather, it is about combining the complementary nature of Lean objectives and the best intentions of business process controls to mitigate damaging enterprise risk.Exhibit 3: A Lean and Controlled Purchase-to-Pay ProcessRecognize NeedSupplier   Manager EmployeeElectronic Funds TransferAuto-Record C/RShip ItemsAuto-Accept OrderSend E-mail for Management ApprovalReview Online CatalogueIT Purchasing SystemWorkflow Evaluates in Real TimeReceive ItemsIf Accepted, Place OrderNoYesApproved?Schedule PaymentReceive E-mail Alert, ApprovePlace OrderJune 2013 | Government Finance Review  49record the transaction, reconcile the invoice with the payment, or handle the related asset). At the same time, guidelines and exceptions regarding approvals and negotia-tion can be built into the automation process to keep the process Lean.Exhibit 3 shows just one suggestion for a Lean and con-trolled purchase-to-pay process. Introducing automation reduces the number of people involved and provides an opportunity to introduce guidelines and exceptions regard-ing approvals and negotiations, increasing the efficiency and effectiveness of the process. Access controls (via user logins), authorization (via system roles), and validation and segregation of functions have been incorporated in this design. One area of potential weakness is the receipt of items and scheduling of payments, but employees would be unlikely to schedule payment without receiving the items — either intentionally or unintentionally — since they would need them to continue with their roles and fulfill their responsibilities.CONCLUSIONSDesigning Lean business processes with control consider-ations does not mean “putting up with fat.” Rather, it is about combining the complementary nature of Lean objectives and the best intentions of business process controls to miti-gate damaging enterprise risk. Managers of Lean initiatives need to follow a set of simple rules:1.  Start out by conducting an initial assessment of the busi-ness process and understanding its gaps and limitations, including risks in the control environment.2.  Create a vision for the future process, including mea-sures of how the process should perform. Start out by eliminating waste without taking control into consider-ation.3.  Create a forum for discussing the enterprise risk associ-ated with the future-process design. Document the likeli-hood and impact of each risk identified.4.  Looking at each documented risk and risk assessment (likelihood and impact), determine whether the risk  50 Government Finance Review | June 2013requires control. The decision to apply a control and the choice of control strategy (access, authorization, segrega-tion, and application) can be determined based on each process risk assessment and the associated cost-benefit ratio of implementing that control strategy. yNotes1.   Shayne Kavanagh, Less Time, Lower Cost, and Greater Quality: Making Government Work Better with Lean Process Improvement, Government Finance Officers Association, 2010.2.  Internal Control — Integrated Framework, Committee of Sponsoring Organizations of the Treadway Commission, December 2011. Although the COSO framework was issued in 1992, it continues to be updated with more detailed explanations, and the basic framework remains timeless.ROBYN L. RASCHKE is assistant professor, Department of Accounting, University of Nevada Las Vegas. MICHAEL T. LEE is assistant professor, Department of Accountancy, Boise State University. ARTI MANN is assistant professor, Department of Computer Science, University of Houston Clear Lake.BKD National Governmental GroupKevin Kemp // Partner972.702.8262 // bkd.com400+ What are you reflecting on? Strengthening compliance? Enhancing internal controls?  Improving cash flow? You need ideas. We can help. BKD National Governmental Group helps more than 400 clients manage change, make wise decisions and stay compliant. Add a personal, highly interactive and attentive service style, and you’ll begin to understand how our expertise can help give you a better vantage point.CLIENTSexperience perspectiveWhat Governments are Saying  About GFOA Consulting“ The GFOA provided consultants with actual public- sector experience who took the time to identify our needs and understand the ERP market. They provided valuable insight during the project, from needs assessment through go-live, and have helped make our project a success.”Call Anne Kinney at 312-917-6102 to find out what  GFOA Consulting can do for you.GFOA Consulting | Research and Consulting Center |  312-977-9700 | consulting@gfoa.org | www.gfoaconsulting.orgGovernment Finance Officers AssociationGFOA Consulting

Lean Processes without Compromising Controls

http://scholarworks.boisestate.edu/cgi/viewcontent.cgi?article=1023&context=account_facpubs

Lean Processes without Compromising Controls

Abstract

Similar works

Full text

Available Versions

Boise State University - ScholarWorks