Assurance over core processes

Any athlete, regardless of discipline, will tell you that core strength is essential.
Stabilising the body’s core through exercise such as Pilates improves all activities such as running, jumping, lifting etc.

The same is true for our organisations. A strong core enables operational excellence, innovation and success.

When it comes to the human body, a kinesiologist uses evidence-based research to improve movement and performance plus treat and prevent injury and disease. Switching this to an organisational context, it’s much like the role of an internal auditor!

Are you an internal audit kinesiologist helping your organisation maintain its core strength?

Core processes are those activities which define an organisation.

It is not the essentials of payroll, cyber security, accounts payable etc – every organisation has these. Yes, they are important, but they are not core to what sustains the organisation.

There are often only a handful of truly core processes.

Every organisation can be stripped back to a few core processes that keep it beating for example:	Thinking about your own organisation
	What are the core processes? Have they been formally defined? How well do you understand them? Is assurance provided on a regular basis? Are they considered as part of all audit            engagements?

These questions might be difficult to answer.
Core processes can easily be taken for granted.
In some organisations they might not be recognised as core until they fall over.

This is where the internal audit kinesiologist comes in!
Resilience and core strength go together.

Identifying core processes and providing assurance helps to maintain the core strength and resilience of an organisation. 

A chief audit executive talking to the governance leaders such as the audit committee chair, CEO and CFO about core processes is much like a Pilates instructor reminding a class to breathe and tighten. The class knows what to do, the routine of the exercises, but they improve and achieve their best with ongoing support.

There is rarely time to audit everything that internal audit would like to provide assurance on. Priorities and difficult decisions have to be made.

If risk-based auditing is guided by residual rather than inherent risk, core processes might be overlooked if well controlled. But are they? Are they over controlled and inefficient?

Think about the core processes in your organisation.
When is the last time they were audited?

It’s not just about auditing them in isolation. The interconnection, inputs and outputs, of core processes in relation to each internal audit engagement could also be a consideration. Internal auditors can use their helicopter view of the organisation to suggest or resurrect low-cost innovations to improve competitiveness and enhance reputation in relation to core activities.

Core strength takes discipline. Being honest about one’s own strengths and weaknesses – working to enhance and develop them. This is where chief audit executives with a good relationship at audit committee (and the board) level can bring risk appetite into discussions and advise on the reality of a control environment that may otherwise be assumed to be okay.

Core process assurance can aid decision-making. Perhaps during these highly stressful times it might be something which is overlooked. In which case it’s up to internal auditors to deliver insights rather than wait for it to be requested.

How confident are you in your organisation’s core strength?
And what are you doing to help improve it?