Limits of process documentation: narratives, flowcharts, and other process descriptions constitute only one component of internal control evaluations.

PROCESS DOCUMENTATION represents an integral part of many audit departments' approach to control reviews. In light of mandated control attestations imposed by the U.S. Sarbanes-Oxley Act of 2002, many companies--and their audit departments--are documenting more processes than ever before.

Today's heightened reporting requirements and control-related imperatives demand that auditors fully examine the purpose and intended result of documenting a process. Although documentation can be a valuable tool, it is best used only for specific types of control evaluations. Auditors need to understand the limitations of process documentation and recognize the need to supplement documentation techniques with methods of identifying a full range internal controls.

UNDERSTANDING THE OBJECTIVES

The word process in process documentation refers to the steps a transaction follows through an organization's systems, applications, and people. The documentation consists of a narrative, flowchart, or some other description of the way the process works.

Process documentation is not required by Sarbanes-Oxley, nor is it a significant feature of The Committee of Sponsoring Organizations of the Treadway Commission's (COSO's) Internal Control-Integrated Framework. Instead, it is a method auditors have developed to demonstrate their understanding of a process and to provide increased reliability on their identification of process-flow controls. Both COSO and Sarbanes-Oxley include provisions for control identification, but not the documentation of a process.

Internal auditors document processes to identify one specific type of internal control--the procedures that help ensure data is entered, manipulated, and output in a complete, accurate, authorized, timely, and safeguarded manner. This method of analysis results in a list of control objectives that the process flow should achieve--such as "Be sure all transactions are authorized"--and it is one of many possible ways to analyze process flow.

Auditors use process documentation to determine how their clients control the flow of data and achieve control objectives. Often, evaluators then identify the risks that threaten achievement of each control objective and document the responses--or "controls"--that prevent or detect these risks.

A PIECE OF THE PUZZLE

When evaluating internal controls, auditors need to recognize that identifying process controls constitutes only one aspect of the overall evaluation. For example, if a company adheres to COSO's Internal Control-Integrated Framework, process flow documentation only sets the stage for addressing two of the framework's components: activity-level Risk Assessment and Control Activities. Process documentation does little to address the remaining COSO components of control--Control Environment, Information and Communication, and Monitoring--or the entity-level objectives and risks a company faces in achieving its objectives. To evaluate internal control fully against the COSO framework, these additional components need to be documented and analyzed as well.

Process documentation only provides an evaluator with enough information to identify an activity's potential risks, as well as the established responses to those risks. Responses might include measures such as information technology (IT) edits, user identifiers, and batch balancing. Once processes have been documented, the evaluator must identify the procedures--or Control Activities--management has in place to ensure the responses are actually carried out.

Control Activities operate at a higher level than process flow--they constitute the means by which management knows activity or process-level responses to risks are working. Examples of Control Activities include segregation of duties, top-level reviews, reconciliations, key performance indicators, policies and procedures, and IT program change controls.

Many evaluation teams confuse process flow controls (which are typically responses to risks) with COSO's Control Activities (which are the measures taken to ensure risk responses are working as intended). When this occurs, evaluators are likely to identify numerous, detailed controls, causing them to lose the advantage of conducting a high-level review of the organization's Control Activities.

ALTERNATIVE METHODS

Although process documentation is probably the most common method of identifying process-level controls, many alternative approaches exist. For example, COSO's Risk Assessment and Control Activities Worksheet--or Risk/Control Matrix (RCM)--facilitates control identification using an activity's objectives and risks, rather than process narratives or flowcharts. While the RCM is often misperceived as a requirement, COSO emphasizes that the matrix is not a required format and that it is not intended as a preferred method of documenting objectives and risks.

When completed by process workers, an RCM seldom needs to be supplemented with flowcharts or narratives--the workers already understand their own processes, can identify risks and controls easily, and can self-assess their activities. Workers can describe the most important steps in the process, identify potential risks, and detail the preventive measures in place to mitigate those risks, without having to produce written documentation. Although items such as desk manuals and procedure guides are important to the control process, they should ultimately exist for the workers, not the auditors. Insufficient process documentation is a potential control weakness that should be remedied by the work unit instead of by those performing the evaluation.

In addition to the COSO matrix, there are several other methods of identifying, documenting, and evaluating process-level controls. Common approaches include:

* Analyzing controls over input, processing, and output. This approach is set forth in the IT Governance Institute's Control Objectives for Information and Related Technology (COBIT) and is aimed specifically at auditing information technology.

* Analyzing an activity's strengths, weaknesses, opportunities, and threats (SWOT). Because many companies use SWOT analysis to evaluate operational areas, this approach can help align the audit effort with the tools used by the rest of the organization.

* Using internal control evaluation checklists. Pre-defined lists of internal controls for typical activities and processes are widely available and provide an excellent starting point for identifying controls.

* Conducting facilitated workshops or surveys. Control self-assessment sessions can also be used to identify controls. When workshops include process workers, control identification can be both efficient and informative, enabling workers to gain additional knowledge about processes by discussing them with each other.

With any of these methods, evaluations conducted exclusively by individuals who are not part of the process under review usually need to be accompanied by flowcharts, enabling evaluators to identify controls and demonstrate that they know enough about the process to reliably perform the evaluation. When this occurs, the total amount of time required to identify controls can be double or triple the time process owners would take, because outside individuals must first learn the process and identify the controls before conducting the evaluation.

The ideal scenario occurs when process employees have already identified their most important controls in company desk manuals, policies, or other documents. Most likely, more and more companies will develop these types of "permanent documentation" in the coming years, particularly in light of ongoing SarbanesOxley compliance efforts.

DOCUMENT WISELY

Although process documentation is a widely used control-identification tool, internal control evaluators are not required by laws or standards to document processes at a detailed level. The U.S. Public Accounting Oversight Board's Auditing Standard No. 2 (AS2) states that external auditors are required to "understand the flow of transactions, including how transactions are initiated, authorized, recorded, processed, and reported and to identify the points within the process at which a misstatement--including a misstatement due to fraud--related to each relevant financial statement assertion could arise." This requirement certainly calls for documentation of financial processes, but not at a detailed level. Similar requirements have existed for years in the American Institute of Certified Public Accountants Statement on Auditing Standard No. 78, and neither this standard nor AS2 require detailed processflow documentation.

While flowcharts and narratives can facilitate control evaluation, they can also lead to unnecessary expenditures. In fact, process documentation, especially when carried out in great detail for routine processes, is a primary driver behind criticisms of Sarbanes-Oxley Section 404 efforts. Many surveys that examined year one of Section 404 compliance indicate that companies over-documented and over-tested routine data flow areas.

Process documentation techniques need to be applied judiciously. Documentation via flowcharts and narratives can yield important information, but it can only help evaluators locate specific types of controls. Moreover, other available tools may be more effective than process documentation for identifying these controls. When considering the use of process documentation techniques, auditors should always keep the limitations, and alternatives, in mind.

To submit a "Back to Basics" article for consideration, or to request coverage of an introductory-level internal audit topic, please e-mail Larry Hubbard at [e-mail]