Professional Services Case Study – Internal Audit

The Brief:

To conduct a series of internal audits for a professional services organisation in line with the requirements of the ISO 9001 Quality Management Systems standard.

The organisation had its annual surveillance audit scheduled within four months of contacting us. It’s management system was said to be well documented, but planned internal audits had not been completed due to a lack of resources. Demands on staff had increased in recent months with the organisation expanding its product delivery into more markets.

What we did:

We reviewed the findings of the last external audit and saw that there had been a number of recommendations noted in the audit report.Generally, these centred around documentation control and refinements to record keeping. Many of these recommendations had not been implemented.

We reviewed the register used to log non-conformances and improvement recommendations and noted that there were a number of outstanding issues that dated back more than six months.

We identified at least six key documented procedures and conducted internal audits on them and their associated records. Concurrent with this was a review of the Quality Manual, various policies and gaining a greater insight of the overall management system and workflow.

Our Findings:

The findings of our audits reinforced the requirement to tighten up some of the record keeping, but also identified the need to update some of the documented procedures. Part of this included an opportunity to also rationalise some of the documented procedures.As with many organisations, and in particular those that have undergone recent expansion, the completeness and timeliness of record keeping had lapsed a little. In addition, the procedures themselves had been originally documented more than two years earlier when the overall business structure and strategy were different. The organisation had moved on, but the procedures had not been consistently updated.

The Outcomes:

In identifying gaps in records and changes in documented procedures, we were able to focus the management team on specific changes that could be readily implemented.Specific records and logs could be updated and procedures revised to reflect current practices.

As with many projects, a by-product was the increased communication and collaboration among the management team and between management and other staff. In improving the level of understanding across all staff, the management team were able to rectify some misconceptions and poor practices that had crept into the workflow. It also raised awareness of how the management system underpinned their operations and the need to keep procedures and records up to date.

After completing the internal audits, we were able to provide resources for guidance and facilitation of our recommended changes. We also assisted in establishing tools for data analysis and templates for improving various record registers and schedules.

And, YES, the organisation maintained its certification, without any non-conformances, following the subsequent external audit.

BPM in the Economic Climate of 2009

Given all the doom and gloom about the economy that is appearing in recent media stories, can companies maintain, let alone implement new systems for Business Process Management in 2009? How do organisations need to change their decision making and business strategy to ensure future success? What changes are needed in business fundamentals or business focus?

Increased external stresses to an organisation will increase pressure on management teams to implement changes within the organisation. These same external stresses can translate to increased performance expectations of individual employees. The challenge then is for the management team to manage the required organisational changes. The way in which an organisation manages change, and its capacity to maintain or expand its business processes will be a reflection of its level of maturity. There are a number of Capability Maturity Models that have been published. The Carnegie Mellon Software Engineering Institute (SEI)[1. Carnegie Mellon Software Engineering Institute website –] defines 5 levels of levels of maturity within their Capability Maturity Model (CMM).

The SEI Capability Maturity Model (CMM) level definitions:

    1. Level 1 – Initial (ad-hoc processes)
    1. Level 2 – Repeatable (basic processes conceptualised and demonstrated)
    1. Level 3 – Defined (processes are documented, standardised and linked to goals)
    1. Level 4 – Managed (processes are quantified, measured and controlled)
    Level 5 – Optimising (continuous process improvement)

Although developed by the Software Engineering Institute, these levels of process maturity are broad enough to apply equally across all types of organisations within any industry. As Harmon (2007, p. xxxv)[2. Harmon, P. 2007, Business Process Change, Second edn, Morgan Kaufmann Publishers] notes, this model is in the same spirit of Total Quality Management (TQM) and leading companies today are focused on moving from from level 4 to level 5.

It’s important to realise the distinction between those companies that have established, documented and linked procedures in place (Level 3, ‘Defined’ processes, or better), and those companies that have identified and completed the initial mapping of their procedures but are yet to refine them, master them and train their staff on the use of the procedures (Level 2, ‘Repeatable’ processes). This distinction sets apart companies that are capable of continuing their Business Process Management (BPM) procedures in times of stress. In times of stress (such as increased economic pressures), companies that are yet to reach a level of established procedures within their BPM system will typically drop their procedures, reverting back to the “old way” of doing things. This is because procedures that are still embryonic rely on individuals to constantly push them into day-to-day operations – they are not “endemic” to the organisation and are readily abandoned when performance expectations of individual employees increase.

Organisations that struggle to maintain their procedures and business systems in times of stress are typically characterised by situations within their organisation such as:

Organisations whose procedures and business systems continue to be used in times of stress are characterised where the organisation:

It could be argued that much of the current economic climate can be attributed to poor decisions made (particularly) by large organisations. Poor decision making may be a reflection of a lack of quality business data and failing to apply good risk analysis to the business data that is available. Putting risk analysis aside for a future post, often business data exists, but it is not collated, presented or communicated to decision makers. To effectively evaluate risk, reliable business data needs to be well presented and communicated effectively to the management team to give them the best opportunity of eliminating poor strategic decisions.

Business data is typically collected through the IT systems in an organisation. At a minimum, IT systems will be used to collate and present business data. Even in tough times, IT still has a role to play. However, I believe it is less likely to involve the implementation of new enterprise-wide (eg. ERP) systems, particularly where they have not been committed to in company budgets to date. Typically there will be a greater focus on analysis of the root cause of process failures leading to more targeted and potentially independent solutions to those failures.

An organisation with established processes that are quantified and have Key Performance Indicators (KPIs) established that are tied to strategic goals will find themselves in a much better position to weather the stresses applied to them from external sources. The requirement remains for people, processes and technology to work together and be aligned with overall business strategy. At what level of maturity an organisation sits, will greatly determine their success in hard economic times.

Bibliography –
SEI Capability Maturity Model article
Portfolio, Programme & Project Management Maturity Model
UK Office of Government Commerce article

BPM Systems