CorporateGovernor series:

The blank sheet of paper: An old tool is new again

Addressing the concerns of the Corporate Governance Community Winter 2011

Contents 1 Introduction 4 The blank sheet of paper approach 10 Value creation with blank sheet of paper auditing 12 Conclusion 12 Additional resources

Introduction

Since commerce began, simple business tools have proven to be some of the most powerful and enduring. The speed and simplicity of the abacus, for example, made it an indispensible tool for thousands of years. Clerks manipulated its pebbles or beads to sum transactions, calculate the costs of goods, and track receivables and payables. Merchants and business leaders used the device to determine solutions to operating challenges and to verify the state and value of their businesses. Likewise today, a simple blank sheet of paper long a business staple can be a powerful device for management and internal audit personnel to assess and create enterprise value.

This paper will explore the use of a blank sheet of paper approach by internal audit to design and deliver consultative business reviews that move the function to a new level of operational excellence and value creation. We believe this approach is excellent for dynamic organizations that find themselves looking at a horizon of change change in the markets, change in competitive positioning, change in customer demands leading to change in the business model and operating landscape. We demonstrate how the blank sheet of paper approach is an agile method (as compared to the structured audit work program approach) for responding to this change.

Since commerce began, simple business tools have proven to be some of the most powerful and enduring.

The blank sheet of paper: An old tool is new again 1

Background

Throughout its history, the internal audit function has played an important role in keeping businesses running properly and efficiently. Historically, the function included not only regulatory and financial auditing, but also broader and more strategic business operations review projects. When the Sarbanes-Oxley (SOX) Act was passed in 2002, however, the role of internal audit contracted to become almost exclusively defined by and confined to financial and regulatory compliance enforcement. Now, nearly a decade later, compliance audit processes are well-defined and streamlined, and audit committees and management are shifting their focus back to enterprise viability and growth. Management teams are now looking for value contributions from all parts of the organization, including internal audit.

One outgrowth of this shift in focus is that operational auditing is regaining traction among management, audit committees and internal audit teams. In 2003, companies in a Corporate Executive Board study reported an average of just 29 percent of their audit projects as operational.1 But a recent survey by Grant Thornton LLP found that today, over 90 percent of the more than 300 chief audit executives (CAEs) interviewed are performing operational audits, with one quarter of them dedicating more than 50 percent of their audit hours to operational auditing. Further, 93 percent of them plan to maintain or increase their levels of operational auditing.2 This trend is important because it perfectly positions internal audit practitioners to move the function to a new level of operational excellence and value creation. Operational audits highlight internal audits capability to move beyond the realm of SOX and other financial compliance. These audits focus not on ensuring compliance, but on higher value-add areas such as freeing up operational flows and creating efficiencies that benefit the whole, not just a subset, of the business. As an advocate for the business with an objective approach, internal audit can identify the root causes of business issues and make recommendations to management on how to improve across multiple functions.

As an advocate for the business with an objective approach, internal audit can identify the root causes of business issues and make recommendations to management on how to improve across multiple functions.

1 2

Audit Organization Profiles: Structures, Roles, Responsibilities, and Resources, Benchmarking Research, Corporate Executive Board September 2003 Grant Thornton LLP, Chief Audit Executive Survey 2011, www.grantthornton.com/CAESurvey

2 The blank sheet of paper: An old tool is new again

In short, internal audit can do more more to address operational and strategic business issues, more to create value for the business and more to demonstrate the value of internal audit as a function. Adding value can be achieved, not just by adding operational audits to the mix, but by employing a simple but powerful tool and using a new approach. That tool is the blank sheet of paper and, as you will see, it supports a consultative approach to management and the business. * Note about the term audit: For many, and particularly for operational units that are unaccustomed to audits, the word audit can conjure up visions of policing exercises with a winner and a loser, increased management oversight, and negative repercussions. For this reason, we use the term business review project or simply project throughout this white paper which may be helpful in place of audit when communicating with business units about an audit project using the blank sheet of paper approach. These terms better communicate the intention of a positive and collaborative effort in which all parties work together to improve the processes and performance of the company.

Adding value can be achieved, not just by adding operational audits to the mix, but by employing a simple but powerful tool and using a new approach.

The blank sheet of paper: An old tool is new again 3

The blank sheet of paper approach

As the name suggests, the blank sheet of paper approach starts with a blank sheet. The sheet is taken by the CAE or other senior internal audit professional into a conversation with an executive about an area of the business that is raising concerns. Since this is a discussion about a special and timely area of concern (suggested by the executive or the audit professional), there is no existing audit plan to address the current situation. Thus, the internal audit professional will use the blank sheet during the discussion to outline not a classic compliance or operational audit, but a consultative value-added business review project. The project will prove or disprove hypotheses about the reason for the business situation and identify areas for improvement. Accordingly, on the blank sheet of paper, the auditor will note: the context of the situation that is causing concern; the specific issue, problem or opportunity to be addressed; the hypotheses (which will be tested) about the factors contributing to the current situation; and the proposed steps and timing to investigate the situation via a business review project.

Significant value enhancements result from the findings and recommendations that follow this type of business review project, including process improvements, efficiency gains and increased customer satisfaction, among others. Thus, the blank sheet of paper approach brings the consultative aspects of internal audit to life and, in focusing the skills and experience of internal audit on key business and operational issues, raises the bar on the value being delivered by the function.
Possible hurdles to the blank sheet of paper approach

Despite the value that blank sheet of paper business review projects can create, internal audit may, on occasion, encounter objections to conducting them. Two initial concerns are addressed below with additional examples of possible barriers and counter-responses presented in Table 3. First, in an organization that has been constrained by compliance auditing, designing a consultative business review project may seem out of scope for internal audit. But, in fact, such projects fall squarely in the purview of the function. The Institute of Internal Auditors (IIA) recognizes the distinction between audits and consultative projects and provides guidance about the appropriateness of consulting projects, saying internal auditors should provide to the audit committee Independent, objective assurance and consulting activities related to assessing the effectiveness of the organizations risk management, control, and governance processes.3

Despite the value that blank sheet of paper business review projects can create, internal audit may, on occasion, encounter objections to conducting them.
3

What services can the internal auditors provide for the audit committee? The Institute of Internal Auditors, www.theiia.org/theiia/about-the-profession/internal-audit-faqs/index.cfm?i=1083

4 The blank sheet of paper: An old tool is new again

The IIA adds, Consulting services are advisory in nature, and are generally performed at the specific request of an engagement client. The nature and scope of the consulting engagement are subject to agreement with the engagement client. Consulting services generally involve two parties: (1) the person or group offering the advice the internal auditor, and (2) the person or group seeking and receiving the advice the engagement client. When performing consulting services the internal auditor should maintain objectivity and not assume management responsibility.4 In other words, the internal audit function is designed and expected to provide this type of review and advice so that management can make decisions and take actions with objective and trusted information. It is only in recent years that the function re-emphasized this broader advisory role. Second, in an organization where compliance and financial auditing comprise the majority of internal audits activity, creating an impromptu project plan may initially be daunting and outside the comfort zone of the audit team. However, the blank sheet of paper approach is successful in part because it is entirely feasible for most senior auditors and audit management to execute just by relying on their current professional training, skills and business experience. There are only a few requirements for applying the approach (see the readiness assessment checklist), most of which are readily attainable by CAEs and other senior auditors that advise management.

Readiness assessment checklist

An internal audit function charter that provides for consultative audits The confidence of the audit committee and management to partner with internal audit to address key business concerns Resources to cover both compliance activities and additional projects Sufficient experience to understand the key drivers of the business Critical thinking and communication skills Training in the consulting craft skills of openended interviewing, hypothesis-driven data analysis, and outcome-based business-process assessment Poise and executive presence A problem-solving mindset

International Standards for the Professional Practice of Internal Auditing (Standards), Issued: October 2008 Revised: October 2010, Page 2 of 2 2010 The Institute of Internal Auditors

The blank sheet of paper: An old tool is new again 5

The blank sheet of paper approach: A framework

Blank sheet of paper business review projects are consultative and so they are structured like consulting engagements with three main stages: assessment and planning, project execution, and reporting and recommendations. Action (to be taken by management)

Assessment and planning

Project execution

Reporting and recommendations

Table 1 on the following page shows the activities, deliverables and advice for each stage.

6 The blank sheet of paper: An old tool is new again

Table 1: Framework for a blank sheet of paper audit Stage 1: Assessment and planning Internal assessment TASKS Assess internal audit readiness for consultative business review project Address readiness gaps (if needed) Develop list of potential projects based on audit exposure to business issues Meet with management to prioritize areas of concern: Select priority project Identify the need to be satisfied or the problem to be addressed Sketch out business review project on blank sheet of paper during meeting Develop a hypothesis of what is and what will betake a stand, create a viewpoint, and then determine its validity and correctness for the client Refine high-level approach and scope and review with management Obtain approval from management to develop formal business review project plan DELIVERABLES Business review project plan Status agendas, status update reports, completed business review Findings report and recommendations Gather information needed to complete preliminary business review project plan Assess skills needed Determine data to be gathered Identify and secure expert resources (if needed) Review refined project plan with management and audit committee Obtain approval from management and audit committee to conduct business review project Follow steps laid out in business review project plan: Interview key people Gather data Review controls Observe the effectiveness and efficiency of processes Assess risks related to fraud, reputation, customer service, the environment, privacy, financial well-being, etc. Corroborate information provided using experts and data and business analytics Record findings Define areas of deeper focus Create additional project steps and refine overall plan Execute steps Record findings Review all raw data and observational notes Create initial findings report, mapping data gathered to areas of project inquiry Analyze findings, assess effects and draw conclusions about root causes of the problems being investigated Develop recommendations for: Immediately addressing the issues that are the focus of the business review Additional steps to take for maximum value creation Draft formal findings report including recommendations Review report with management, audit committee, and (if appropriate) with the departments or individuals reviewed Planning Stage 2: Project execution Project plan execution Project plan refinement Stage 3: Reporting and recommendations Findings analysis Reporting and recommendations

BEST PRACTICES5 Meet with management 14 times per year to solicit feedback on areas of concern, provide input regarding the audit plan, and keep them informed about the internal audit schedule Meet away from an executives work area to allow him/her to be more candid in sharing concerns and identifying areas for potential business review projects Maintain a running list of potential business review projects to suggest to management Include time in the internal audit calendar to handle ad hoc requests for assistance and consulting projects. Over time, seek to have a 50-50 balance between compliance and other audit projects Share analytic scripts and analysis with division or line-of-business leaders to allow them to continue to monitor their processes and operations after the review project Create a value scorecard highlighting the value created by each internal audit project, especially business review projects Share upcoming, in-process and completed projects (including value scorecards) via monthly activity reports and year-end summaries Link business review project findings to the stated strategies and metrics of the organization, business unit, or department (e.g., costs, cash flow, efficiency, etc.) Create a summary of relevant business review findings for the management of the areas reviewed Develop a road show for top and middle management to share findings and publicize the consultative and value-added capabilities of internal audit

Adapted from interviews with Grant Thornton partners; also adapted from the Chief Audit Executive Discussion Group: Highlighting Internal Audits Value Contribution, The Corporate Executive Board, 2009

The blank sheet of paper: An old tool is new again 7

The blank sheet of paper approach: Case studies

Using the blank sheet of paper approach demonstrates and reinforces internal audits capabilities as a high-impact partner helping management uncover the causes of and solutions to a variety of business issues. This type of project may be commissioned by a senior executive, a task force or the audit committee so that the organization can focus on a variety of operational concerns. The case studies below show a range of situations to which this approach has been successfully applied.

Manufacturing industry Business concern: Why are capital costs of construction so high on every factory we build? Situation: A manufacturing company

Consumer products industry Business concern: Why did the market launch of a particular product fail? Situation: A consumer products company had completed the

was midway through a 10-year effort to renovate the manufacturing facilities that were the core of its physical plant assets. Construction was coming in close to budget, but although the CEO had held numerous meetings with engineering, operations and other departments, he felt that the estimated costs of renovating the facilities were too high. He approached his CAE in an effort to understand whether the cost estimates were out of line.
Business review project approach: The CAE outlined a

launch of its core product 18 months earlier in an emerging African market. Sales were slow and decreasing. The audit committee commissioned an audit project to determine the reason the launch had failed.
Business review project approach: The audit committee

project plan to review the major cost elements of factory construction. He quickly identified one cost driver that was common to all projects but also anomalous: A specific type of reinforced steel was being used for all of the facilities girders, and its cost was an order of magnitude higher than the average cost for construction steel. The CAE refined the review project to focus more closely on this cost element, gathering information on typical steel grades used for comparable projects and bringing in an independent engineering expert with construction and metallurgy experience.
Results: The business review revealed that the contractor had

assigned the CAE and three additional internal audit resources to assess the situation. Had the approved market launch plan been followed? Was the underlying market study flawed? Was the market ready for such products? Was there a problem with sales tracking? The internal audit team interviewed management in the product, marketing and sales departments to compare the planned and actual launch processes. The team also looked at how sales were made and recorded by channel partners.
Results: The team discovered that although the launch plan

specified the use of a very expensive type of steel that was only available from a single source. While expensive, the steel would ensure stability in the structure for decades to come. These findings were reported to the CEO, who welcomed the explanation; it confirmed not only the high costs but also the value of the use of this expensive product. He and the management team ultimately determined that the design and architecture specified were what was needed for the facilities and would deliver cost savings over the long run. They also put in place a process for more rigorous review of and justification for high-value construction components. The project provided this process improvement as well as an objective and independent validation of the CEOs gut feeling related to construction costs.
8 The blank sheet of paper: An old tool is new again

was solid, made sense for the marketplace, and had been closely followed, there was a problem with sales tracking. Channel partners were reporting product shipments as stolen or damaged while keeping revenues for product they were selling. The company was losing material sums of money due to fraud and poor tracking controls. A process reengineering effort subsequently resolved the problem, and the company now enjoys a verifiable majority share of the market for its product in the country. The review project gave the audit committee and marketing and sales heads an outside perspective on an important internal controls issue and also led to a strengthened business process.

Agriculture industry Business concern: Why does the production cost of seed corn continue to rise? Situation: A leading agricultural company struggled with

Industry: Retail Business concern: What was causing a slowdown in sales and returns and affecting customer satisfaction? Situation: A retail CFO had noticed shifts in three areas of the

rising costs of a key input: seed corn. Management was concerned that the explanation of weather as the reason for the rising costs was insufficient, putting the company at risk from market manipulation, shortages, trade regulations or other factors.
Business review project approach: The internal audit team

business a dip in sales, an unusual decrease in return charges and a decline in measured customer satisfaction. Wondering if there was a connection, she asked the internal audit team to undertake a project to see whether the three items were related and to understand why sales and returns had slowed.
Business review project approach: The team first verified

developed an extensive business review project plan that looked at multiple factors potentially affecting seed corn production, yield and costs. The team began by charting the yield and related costs of seed corn year-over-year for a 10-year period in key U.S. growing regions. The team also interviewed growers, dealers, university agricultural experts and agricultural finance organizations. The team gathered data on drought conditions, weather patterns and insect infestations and then engaged outside weather, plant and insect experts to help analyze the data.
Results: Using its business sense, a thorough approach and

that sales and the number of returns had slowed and found that they were down nearly 20 percent year-over-year. The CAE met with and interviewed customers, warehouse staff, product management and customer service representatives to understand their experience with the returns process. The order-to-cash sales process seemed to be operating properly so the team looked at the returns process, evaluating restocking customer claims, returns and returns-credit-granting processes.
Results: The business review revealed that a new approval

outside corroboration, the internal audit team ultimately confirmed that weather was indeed a key driver affecting seed corn production, yield and costs. With this information, management was confident about the organizations greatest source of risk related to this key input and could focus its business planning, purchasing and hedging models around risks in this area. The executives who requested the project appreciated the independent review and analysis, which validated the anecdotal notion that weather was among the most important and difficult-to-control variables in its agricultural production.

process for returns credit had created a choke point in the overall returns process. The queue of returns was growing significantly, while the approval requirements had slowed the process from the usual week to two months. Customers, dissatisfied with the service they were receiving, were returning fewer items and ultimately buying less from the company, defecting to other vendors that had similar products with easier returns processes. The audit team helped redesign the returns credit process, and additional staff was brought on to clear the backlog. Customers who had not shopped in the companys stores for the past six months were notified of the new, faster returns process and offered an incentive to return to their local store. Three months later, sales and customer satisfaction were almost back to previous levels and on the rise. The CFO received an objective review of this problem area because the internal audit staff already knew many aspects of the company well, did not have a vested interest in how the process had been designed, and was free to come up with creative ideas and suggestions for improving the overall process.

The blank sheet of paper: An old tool is new again 9

Value creation with blank sheet of paper auditing

As the case studies show, the blank sheet of paper approach can be used to focus on almost any area of the business or any business issue. Accordingly, the value created by this type of business review can be large or small, immediate or long-term, tangible or intangible. Some typical value enhancements are shown in Table 2.

Table 2: Value enhancements produced by using a blank sheet of paper approach Value category Top-line Bottom-line Sample results Increased customer satisfaction scores Increased revenue Reduced return rates Lower source material costs Increased productivity Reduced headcount Increased brand value Process improvement Reduced financial and operational risk Greater fraud risk awareness

Enterprise-wide

10 The blank sheet of paper: An old tool is new again

Table 3: Sample responses to objections raised about using the blank sheet of paper approach

Objection How can internal audit be consultative and remain independent?

Response One of the major benefits to having internal audit conduct a business review is the functions ability to be objective in its approach to reviewing and analyzing business problems. While its methods rely on objectivity, its ability to add value also stems from its intent, as a member of the management team, to create a positive business outcome. The function can thus remain objective about its findings while steering its recommendations toward those with the most likely positive outcome for the business. Blank sheet of paper projects only require the skills, problem-solving mindset and expertise senior audit professionals have already cultivated via their accounting and business experience. Applying the blank sheet of paper technique will build confidence and success. Independent thinking is a must! According to the IIA,6 the value proposition of the internal audit function is best depicted as providing assurance, insight and objectivity. These benefits certainly apply to the financial arena, but auditing skills and expertise can be applied to any aspect of a business. Auditors are independent and have carte blanche to examine a companys sacred cows, objectively assess root causes and consequences, and recommend approaches to improve the business and minimize risks. In order to oversee and permit value-added audits, a companys audit committee should include language in the charter authorizing the internal audit function to undertake consultative audits. The objectivity, skills and knowledge of internal auditors are significant and can add value to an organizations operational, business, internal control, risk management and governance processes. Additionally, a balanced and effective internal audit portfolio of activities can reassure stakeholders such as customers, vendors, business partners, suppliers, regulators, employees, service providers and shareholders, among others. Internal audit provides the benefits of relative independence and objectivity. They are free to think broadly and apply knowledge and experience from other parts of the company. This benefit applies not only to the company broadly, but also to any department that is the subject of a business review project. Such projects create and enforce accountability. They also identify process improvements, control refinements, and other changes needed within an operating department to help it achieve the organizations business goals.

Creating blank sheet of paper project plans is not in the comfort zone of our internal audit team.

Internal audit should stick to the financial accounting and controls aspects of business issues. Other areas are outside the functions scope.

Our internal auditors are not chartered to conduct operational audits.

Why involve internal audit? Arent the operating departments in the best position to evaluate issues in their areas? Shouldnt they be held accountable?

What is internal auditing? The Institute of Internal Auditors, www.theiia.org/theiia/about-the-profession/internal-audit-faqs/index.cfm?i=1077

The blank sheet of paper: An old tool is new again 11

Conclusion

With companies shifting focus from strict compliance to business viability and growth, internal audit is poised to be a high-impact partner in creating business value. To do so, it must strive to create positive business outcomes, moving out of the compliance comfort zone and into a consultative role as a trusted adviser to management. CAEs must proactively identify, suggest and execute value-added projects that leverage the skills and experience of the internal audit team to maximum potential.

In the hands of an experienced CAE, the blank sheet of paper approach is a powerful way to imagine and design business review projects which help businesses achieve new levels of operational excellence and demonstrate the internal audit functions significant and growing value.

Internal auditors must embrace simple but powerful tools like the ultra-simple blank sheet of paper. In the hands of an experienced CAE, the blank sheet of paper approach is a powerful way to imagine and design business review projects which help businesses achieve new levels of operational excellence and demonstrate the internal audit functions significant and growing value. Now is the perfect opportunity to interject a blank sheet of paper project to maximize the value of the operating environment changes that organizations are facing. The results of such projects will help organizations know where change is working and not working and where it has created or not created value. Be bold! Envision a new role for internal audit and the value of what you will write on your next blank sheet of paper.

Additional Resources
The Audit Committee Handbook www.grantthornton.com/ACHandbook COSOs Guidance on Monitoring Internal Control Systems www.grantthornton.com/COSO Institute of Internal Auditors, Whats Your Definition of Value? Tone at the Top, Issue 49, November 2010 www.theiia.org/download.cfm?file=38628 Information overload: How to make data analytics work for the internal audit function www.grantthornton.com/informationoverload

About the author Warren Stippich Partner, Business Advisory Services T 312.602.8499 E Warren.Stippich@us.gt.com Warren Stippich is a partner and the practice leader of Grant Thornton LLPs Business Advisory Services group in Chicago. In addition, he is the National Governance, Risk and Compliance Solution Leader. He has more than 20 years of experience working with multinational, entrepreneurial and high-growth public and private companies. Stippich brings experience to the business risk consulting and internal audit services areas from both public accounting and industry perspectives. He has served as a CAE of a publicly traded company in Chicagoland. Stippich is a Certified Internal Auditor and CPA (Illinois). He is a member of the Institute of Internal Auditors, American Institute of Certified Public Accountants and the Illinois CPA Society. Stippich received his B.S. in accountancy from the University of Illinois at Urbana-Champaign and he serves on two not-for-profit boards of directors.

12 The blank sheet of paper: An old tool is new again

Offices of Grant Thornton LLP

National Office 175 West Jackson Boulevard Chicago, IL 60604 312.856.0200 Washington National Tax Office 1250 Connecticut Ave. NW, Suite 400 Washington, DC 20036-3531 202.296.7800 Arizona Phoenix California Irvine Los Angeles Sacramento San Diego San Francisco San Jose Woodland Hills Colorado Denver Florida Fort Lauderdale Miami Orlando Tampa Georgia Atlanta Illinois Chicago Oakbrook Terrace 602.474.3400 949.553.1600 213.627.1717 916.449.3991 858.704.8000 415.986.3900 408.275.9000 818.936.5100 303.813.4000 954.768.9900 305.341.8040 407.481.5100 813.229.7201 404.330.2000 312.856.0200 630.873.2500

Kansas Wichita Maryland Baltimore Massachusetts Boston Michigan Detroit Minnesota Minneapolis Missouri Kansas City St. Louis Nevada Reno New Jersey Edison New York Long Island Downtown Midtown North Carolina Charlotte Raleigh Ohio Cincinnati Cleveland

316.265.3231 410.685.4000 617.723.7900 248.262.1950 612.332.0001 816.412.2400 314.735.2200 775.786.1520 732.516.5500 631.249.6001 212.422.1000 212.599.0100 704.632.3500 919.881.2700 513.762.5000 216.771.1400

Oklahoma Oklahoma City Tulsa Oregon Portland Pennsylvania Philadelphia South Carolina Columbia Texas Austin Dallas Houston San Antonio Utah Salt Lake City Virginia Alexandria McLean Washington Seattle Washington, D.C. Washington, D.C. Wisconsin Appleton Milwaukee

405.218.2800 918.877.0800 503.222.3562 215.561.4200 803.231.3100 512.391.6821 214.561.2300 832.476.3600 210.881.1800 801.415.1000 703.837.4400 703.847.7500 206.623.1121 202.296.7800 920.968.6700 414.289.8200

About Grant Thornton Advisory Services

Grant Thornton LLP All rights reserved U.S. member firm of Grant Thornton International Ltd

Today you need trusted advisers who focus on insightful and innovative solutions for your complex issues, such as complying with changing legislation, managing risk, containing costs, streamlining business processes and identifying strategic transaction opportunities. Grant Thorntons Advisory Services professionals can deliver value by providing independent advice to public, private and not-for-profit organizations. Our specialists combine insight and innovation from multiple disciplines with a wide range of business and industry knowledge to deliver value to the dynamic organizations in the middle market. To learn more, visit www.GrantThornton.com/advisory.