Compliance audit

89
UNDERSTANDING AUDIT, UNDERSTANDING AUDIT, REVIEW AND CONTINOUS REVIEW AND CONTINOUS IMPROVEMENT IMPROVEMENT

description

Compliance audit

Transcript of Compliance audit

Page 1: Compliance audit

UNDERSTANDING AUDIT, UNDERSTANDING AUDIT, REVIEW AND CONTINOUS REVIEW AND CONTINOUS

IMPROVEMENTIMPROVEMENT

Page 2: Compliance audit

WORDS ON MARBLESWORDS ON MARBLES

““It is not the strongest of It is not the strongest of the species that survive, the species that survive, nor the most intelligent, nor the most intelligent, but the one most but the one most responsive to change”responsive to change”

Charles DarwinCharles Darwin

Page 3: Compliance audit

ARE YOU READY ?

Page 4: Compliance audit

WHAT DOES “AUDIT” MEAN?

Independent review and examination Independent review and examination of records and activities to assess the of records and activities to assess the adequacy of internal controls, to adequacy of internal controls, to ensure compliance with established ensure compliance with established policies and operational procedures, policies and operational procedures, and to recommend necessary and to recommend necessary changes in controls, policies, or changes in controls, policies, or procedures.procedures.

Page 5: Compliance audit

CONT….. Examination of financial operations and Examination of financial operations and

workwork Review of compliance with applicable laws Review of compliance with applicable laws

and regulationsand regulations Evaluation of economy and efficiency of Evaluation of economy and efficiency of

operationsoperations Evaluation of effectiveness in achieving Evaluation of effectiveness in achieving

program resultsprogram results

Page 6: Compliance audit

PURPOSE OF “AUDIT”

In the assistance context, it In the assistance context, it means means • A look at the past performance of A look at the past performance of

an entity, program or function to an entity, program or function to determine whether funds and determine whether funds and property were properly property were properly administered and whether the administered and whether the projects have met or fallen short projects have met or fallen short of program intent and of program intent and expectations.expectations.

Page 7: Compliance audit

PREPARING TO BE AUDITED

This Is NOT a ConfrontationThis Is NOT a Confrontation Make Your Self AvailableMake Your Self Available Know What The Scope/Objectives AreKnow What The Scope/Objectives Are Know What Type of Data Will be CollectedKnow What Type of Data Will be Collected Know What Data Shouldn’t be CollectedKnow What Data Shouldn’t be Collected

Page 8: Compliance audit

OBJECTIVES OF AUDIT

AuditSafeguarding

of Assets

Improved Data Integrity

Improved System Effectiveness

Improved System

Efficiency

Page 9: Compliance audit

AUDIT PLANNING PROCESS

Develops annual planDevelops annual plan Plan based on:Plan based on:

• Legal requirementsLegal requirements• knowledge and experienceknowledge and experience• Requests (Bureaus and Congress)Requests (Bureaus and Congress)• Government wide interest Government wide interest

Unanticipated auditsUnanticipated audits

Page 10: Compliance audit

EFFECTIVE AUDIT

Early Early involvementinvolvement

Informal auditsInformal audits Knowledge Knowledge

sharingsharing Self-Self-

assessmentsassessments

Page 11: Compliance audit

ELEMENTS OF AUDIT

Physical and EnvironmentalPhysical and Environmental System AdministrationSystem Administration Application Software Application Software Application DevelopmentApplication Development Network SecurityNetwork Security Business ContinuityBusiness Continuity Data IntegrityData Integrity

Page 12: Compliance audit

INTERNAL VS EXTERNAL

Audit function can Audit function can be performed by;be performed by;

INTERNALLYINTERNALLY EXTERNALLYEXTERNALLY

Page 13: Compliance audit

THE INTERNAL

INTERNALLYINTERNALLY EXTERNALLYEXTERNALLY

Internal audit is Internal audit is an an independent appraisal of independent appraisal of operations, conducted operations, conducted under the direction of under the direction of management, to assess management, to assess the effectiveness of the effectiveness of internal administrative internal administrative and accounting controls and accounting controls and help ensure and help ensure conformance with conformance with managerial policies managerial policies

Page 14: Compliance audit

INTERNAL CONTROL Internal control is broadly defined as a Internal control is broadly defined as a

process, effected by management and process, effected by management and other personnel, other personnel, designed to provide designed to provide reasonable assurance that the objectives reasonable assurance that the objectives of the area of the area are being achieved in the are being achieved in the following categories:following categories:• Effectiveness and efficiencyEffectiveness and efficiency of operations of operations

including the use of the entity’s resources.including the use of the entity’s resources.• Reliability of financial reportingReliability of financial reporting, including , including

reports on budget execution, financial reports on budget execution, financial statements, and other reports for internal and statements, and other reports for internal and external use.external use.

• ComplianceCompliance with applicable laws and with applicable laws and regulations.regulations.

• Control Control (safeguarding) of assets.(safeguarding) of assets.

Page 15: Compliance audit

BENEFFITS OF INTERNAL CONTROLS

The plan of organization, methodsThe plan of organization, methods

and procedures adopted by and procedures adopted by management to ensure that resource management to ensure that resource use is consistent with laws, regulations, use is consistent with laws, regulations, and policies; and policies;

That resources are safeguarded against That resources are safeguarded against waste, loss and misuse;waste, loss and misuse;

And that reliable data is obtained, And that reliable data is obtained, maintained, and fairly disclosed in maintained, and fairly disclosed in reports. (General Accounting Office)reports. (General Accounting Office)

Page 16: Compliance audit

ELEMENTS OF INTERNAL CONTROL

Accounting Accounting • Cash Ledgers Cash Ledgers • Support Documents Support Documents

• Audit trailAudit trail

Business records Business records • Banking Banking • Employment Employment • Time Sheets Time Sheets • ContractsContracts

Policies and Policies and procedures procedures • Position Position

DescriptionsDescriptions• Roles and Roles and

ResponsibilitiesResponsibilities• Personnel manualPersonnel manual• Travel ProceduresTravel Procedures• Training PolicyTraining Policy• Procurement PolicyProcurement Policy

Page 17: Compliance audit

INTERNAL AUDIT REPORTING STRUCTURE

Non-IT Audit Team Members

CEO

Board Audit Committee

Head of Audit Dept

Head of Non-IT Audit Head of IT Audit

IT Audit Team Members

Page 18: Compliance audit

DESIGN OF INTERNAL CONTROLS

A prerequisite to designing good internal controls A prerequisite to designing good internal controls used by an organization is to have used by an organization is to have clear, precise, clear, precise, and quantifiable objectives in place. and quantifiable objectives in place.

An excellent place to start when identifying An excellent place to start when identifying objectives is the objectives is the Strategic Plan and Mission Strategic Plan and Mission Statement of your areaStatement of your area..

Objectives are needed in order to determine what Objectives are needed in order to determine what are the necessary controls to put in place and are the necessary controls to put in place and when the controls have been successful. when the controls have been successful.

When objectives have been established, the When objectives have been established, the risks risks associated with accomplishing each objectiveassociated with accomplishing each objective can can be determined.be determined.

Only when risks associated with the activities Only when risks associated with the activities involved in completing objectives are identified involved in completing objectives are identified can the can the required controls be determined to ensure required controls be determined to ensure successful completion of the objectives.successful completion of the objectives.

Page 19: Compliance audit

AUDIT MONITORING

The effectiveness of any internal The effectiveness of any internal control system must be control system must be monitored to be successful. monitored to be successful.

Departmental reviews, quality Departmental reviews, quality control auditing, internal control auditing, internal auditing and external auditing auditing and external auditing are the primary means of are the primary means of monitoring an internal control monitoring an internal control system.system.

Page 20: Compliance audit

THE EXTERNAL

INTERNALLYINTERNALLY

EXTERNALLYEXTERNALLY

External Audit External Audit is is an audit an audit conducted by conducted by an individual of an individual of a firm that is a firm that is independent of independent of the company the company being auditedbeing audited

Page 21: Compliance audit

RISK ASSESSMENT

Internal control should provide for an Internal control should provide for an assessment of the risks the area faces from assessment of the risks the area faces from both external and internal sources. both external and internal sources.

A precondition to risk assessment is A precondition to risk assessment is establishment of clear, consistent area establishment of clear, consistent area objectives. objectives.

Risk assessment is the identification and Risk assessment is the identification and analysis of relevant risks associated with analysis of relevant risks associated with achieving the objectives, and forming a achieving the objectives, and forming a basis for determining how risks should be basis for determining how risks should be managed.managed.

Page 22: Compliance audit

AUDIT PROCESS ObjectivesObjectives

• What are we doing and why?What are we doing and why? ScopeScope

• Program, time periodProgram, time period MethodologyMethodology

• HowHow FindingsFindings

• ResultsResultsUNDERSTANDING CONTROLS UNDERSTANDING CONTROLS A top-down approach -used when considering controls. A top-down approach -used when considering controls.

Page 23: Compliance audit

GENERAL AUDIT CONTROLS

AUDIT CONTROLSAUDIT CONTROLSAUDIT CONTROLSAUDIT CONTROLS

GeneralGeneralControlsControlsGeneralGeneralControlsControls

IT Concerns and Issues

Disaster Recovery • Business Resumption Plans• BRP Testing• Alternate Processing

Physical Security • Physical Access• Fire Protection• UPS

Backup/Contingency Planning • Data Backups• Restore Procedures• Offsite Storage

Change Management Program Change Controls• Tracking• Change Approvals

Page 24: Compliance audit

AUDIT ROLE

Advising the Audit Committee and Advising the Audit Committee and senior management on internal senior management on internal control issuescontrol issues

Performing Risk AssessmentsPerforming Risk Assessments Performing:Performing:

• Institutional Risk Area AuditsInstitutional Risk Area Audits• General Controls AuditsGeneral Controls Audits• Application Controls AuditsApplication Controls Audits• Technical Controls AuditsTechnical Controls Audits• Internal Controls advisors during Internal Controls advisors during

systems development and analysis systems development and analysis activities.activities.

Page 25: Compliance audit

ROLES OF AUDIT TEAM

Entity-Level Controls

Physical Facility

Network Intra

Operating System

Middleware

DatabaseApplication

Auditor

Information Systems Auditor

Support for Financial Auditors

Financial Auditor

Page 26: Compliance audit

AUDIT GOVERNANCE

……the process for controlling an the process for controlling an organization’s resources, including organization’s resources, including information and communication information and communication systems, and technology. systems, and technology.

……using to promote an organization’s using to promote an organization’s objectives and enable business objectives and enable business processes and to manage and processes and to manage and control related riskscontrol related risks..

Page 27: Compliance audit

UNDERSTANDING CONTROLS

control control is a process is a process that provides that provides assurance for assurance for information and information and information services, information services, and help to mitigate and help to mitigate risks associated with risks associated with use of …...use of …...

Page 28: Compliance audit

IMPORTANCE OF CONTROLS

Implementing Implementing effective controls will effective controls will improve efficiency, improve efficiency, reliability, and reliability, and flexibility.flexibility.

Page 29: Compliance audit

BASED ON RISK

Analyzing RiskAnalyzing Risk• Identify and Identify and

prioritize risks prioritize risks • Consider risk in Consider risk in

determining the determining the adequacy of controlsadequacy of controls

• Define risk Define risk mitigation strategy – mitigation strategy – accept/mitigate/ accept/mitigate/ shareshare

Page 30: Compliance audit

MONITORING

Monitoring Monitoring ControlsControls• Ongoing Ongoing

monitoring/special monitoring/special review/automated review/automated continuous continuous auditingauditing

Page 31: Compliance audit

STEPS OF AN AUDIT

Planning PhasePlanning Phase Testing PhaseTesting Phase Reporting Reporting

PhasePhase

Page 32: Compliance audit

PLANNING PHASE

Entry MeetingEntry Meeting Define ScopeDefine Scope Learn ControlsLearn Controls Historical Historical

IncidentsIncidents Past AuditsPast Audits

Site SurveySite Survey Review Current Review Current

PoliciesPolicies QuestionnairesQuestionnaires Define Define

ObjectivesObjectives Develop Audit Develop Audit

Plan / ChecklistPlan / Checklist

Page 33: Compliance audit

TESTING PHASE

Meet With Site Meet With Site ManagersManagers• What data will be What data will be

collectedcollected• How/when will it How/when will it

be collectedbe collected• Site employee Site employee

involvementinvolvement• Answer questionsAnswer questions

Data CollectionData Collection• Based on Based on

scope/objectivesscope/objectives Types of DataTypes of Data

• Physical securityPhysical security• Interview staffInterview staff• Vulnerability Vulnerability

assessmentsassessments• Access Control Access Control

assessments assessments

Page 34: Compliance audit

REPORTING PHASE

Exit Meeting - Short Exit Meeting - Short ReportReport• Immediate problemsImmediate problems• Questions & answer Questions & answer

for site managersfor site managers• Preliminary findingsPreliminary findings• NOT able to give in NOT able to give in

depth informationdepth information

Long Report After Long Report After Going Through DataGoing Through Data• Intro defining Intro defining

objectives/scopeobjectives/scope• How data was How data was

collectedcollected• Summary of Summary of

problemsproblems Table formatTable format Historical data (if Historical data (if

available)available) RatingsRatings FixesFixes Page # where in Page # where in

depth description isdepth description is

Page 35: Compliance audit

PHASES OF THE INFORMATION AUDIT

Systems AuditSystems Audit Structure of the Financial Structure of the Financial

Statement AuditStatement Audit Auditing Around the ComputerAuditing Around the Computer Auditing With The ComputerAuditing With The Computer

Page 36: Compliance audit

SYSTEMS AUDIT

Initial review and Initial review and evaluation of the evaluation of the area to be audited, area to be audited, and the audit plan and the audit plan preparationpreparation

Detailed review and Detailed review and evaluation of evaluation of controlscontrols

Compliance testingCompliance testing Analysis and Analysis and

reporting of results reporting of results

Page 37: Compliance audit

STRUCTURE OF THE FINANCIAL STATEMENT AUDIT

TransactionsTransactions AccountingSystem

AccountingSystem

FinancialReportsFinancialReports

Interim Audit

Compliance Testing

Financial Statement Audit Substantive

Testing

Page 38: Compliance audit

AUDITING AROUND THE SYSTEM• The auditor ignores computer The auditor ignores computer

processing. Instead, the auditor processing. Instead, the auditor selects source documents that have selects source documents that have been input into the system and been input into the system and summarizes them manually to see if summarizes them manually to see if they match the output of computer they match the output of computer processingprocessing..

Processing

Page 39: Compliance audit

AUDITING WITH THE COMPUTER

• The utilization of the computer The utilization of the computer by an auditor to perform some by an auditor to perform some audit work that would audit work that would otherwise have to be done otherwise have to be done manually.manually.

Page 40: Compliance audit

ATTITUDES

VALUES

BELIEFS

BEHAVIOURS

20%

80%

Page 41: Compliance audit

REVIEW

Know what is sensitive information required for audit operation Understand that there are different levels of sensitivity in audit operation Be able to identify the minimum audit requirements for each level

Page 42: Compliance audit

REPORT REVIEW

Do the reports –Do the reports –• Provide sufficient information?Provide sufficient information?• Show that adequate progress is Show that adequate progress is

being made?being made?• Raise red flags?Raise red flags?• Contain information that is useful Contain information that is useful

for performance measures?for performance measures?

Page 43: Compliance audit

THE DEMMING CYCLE THE DEMMING CYCLE W.Edwards DemmingW.Edwards Demming

PlanPlan

ControlControl ActAct && DoDo

ImprovementImprovement

CheckCheck

Page 44: Compliance audit

CASE - It can’t be done!CASE - It can’t be done!

““Management wants us to add on Management wants us to add on these quality activities to our these quality activities to our regular duties without giving us regular duties without giving us the additional time [to accomplish the additional time [to accomplish them] -- it can’t be done!”them] -- it can’t be done!”

Discussion - How can it be done?Discussion - How can it be done? Has your employer implemented Has your employer implemented

any quality improvement any quality improvement programs?programs?

How was it done?How was it done?

Page 45: Compliance audit

QUALITY? - CONVINCING MANAGEMENT

Loss of productionLoss of production Loss of customersLoss of customers Loss of businessLoss of business Loss of jobsLoss of jobs Class - Can you list some more Class - Can you list some more

reasons?reasons?

Page 46: Compliance audit

Quality? - Convincing Management Quality is no longer just a Quality is no longer just a

technical issue, it is a business technical issue, it is a business issue.issue.

In order for a quality program to In order for a quality program to succeed, top management must succeed, top management must be involved and committed to be involved and committed to its success.its success.

A company’s success is directly A company’s success is directly related to management’s related to management’s commitment to quality.commitment to quality.

Page 47: Compliance audit

QUALITY PROGRESS

Market

research

Custome

r

service

Marketing,

administra

tive

support

Inspecti

on

Test

Producti

on

Proce

ss

Control

Operatio

ns

planning

Specifica

tion

Product

development

and design

Market

rese

arch

Purchasin

g

Suppliers

Wholesaling

Retailing

Use

Feedback

Page 48: Compliance audit

CONTINUOUS IMPROVEMENT

4848

Represents continual improvement of process & customer satisfaction which

Involves all operations & work units

Page 49: Compliance audit

Continuous ImprovementContinuous ImprovementI

Am

Responsible

for Quality

As a

Good Process Owner or User

I will:

As a

Good Supplier

I will:

As a

Good Customer

I will:

1. Agree on and document my requirements with my supplier.

2. Return defective inputs to my supplier promptly and tactfully.

3. Feedback input quality data to my supplier.

1. Understand my customer requirements, and agree on and document my deliverables.

2. Reduce defects and variations in my output.

3. Measure my output quality from my customer’s perspective.

1. Learn to apply the tools of quality - teach others.

2. Continuously improve my process - reduce defects, cycle time, and know benchmarks.

3. Document and display my process, defect levels, and CI projects.

Requirements and feedback

My input

My supplier

My customer

Requirements and feedback

My output

Page 50: Compliance audit

COMPETITIVE STANDING

Page 51: Compliance audit

ATTRIBUTE COMPARISON - RADAR GRAPH

0

20

40

60

80

100

120

140

160

180

Safety

Performance

Quality

Field serviceEase of use

Company image

Plant service

Company X Competitor A Competitor B

Page 52: Compliance audit

Maintain Status quo Leverage competitive

strength

Assign little or no priority on action.

Add resources to achieve

improvement

PERFORMANCE - SATISFACTION MAP

200

60

40

80

100

17.5 35 52.5 70

Importance

Per

form

ance

(%

sat

isfi

ed)

Product

Sales

Repairs

Billing

Page 53: Compliance audit

CONVINCING UPPER MANAGEMENT

Estimate the size of quality related Estimate the size of quality related losses.losses.

Identify ways of improving quality.Identify ways of improving quality. Estimate the savings and other Estimate the savings and other

benefits.benefits. Calculate return on investment (ROI)Calculate return on investment (ROI) Use a successful case history to Use a successful case history to

justify a broader program.justify a broader program. If all else fails, take pictures of If all else fails, take pictures of

waste and/or hazards waste and/or hazards

Page 54: Compliance audit

ARE QUALITY APPROACHES INFLUENCED BY CULTURE?

Quality Approaches are Influence by Culture

The US approach has historically been

command-and-control oriented.

The Japanese approach is based on

an ethic of consistency and emphasis on

reduction of waste.

The Europeans have adopted broad

standards that can be adapted to the

diverse nation states of the EC.

Page 55: Compliance audit

NATIONAL AND INTERNATIONAL QUALITY AWARDS

Malcolm Baldrige National Malcolm Baldrige National Quality AwardQuality Award

Deming PrizeDeming Prize European Quality AwardEuropean Quality Award Shingo PrizeShingo Prize

The US approach has

historically been command-and-

control oriented.

Page 56: Compliance audit

THE MALCOLM BALDRIGE NATIONAL QUALITY AWARD

The President of the United States traditionally The President of the United States traditionally presents the Awards at a special ceremony in presents the Awards at a special ceremony in Washington, DC. Awards are made annually to Washington, DC. Awards are made annually to recognize U.S. organizations for performance recognize U.S. organizations for performance excellence. The Award eligibility categories are:excellence. The Award eligibility categories are:• manufacturing businessesmanufacturing businesses• service businessesservice businesses• small businessessmall businesses• education organizationseducation organizations• health care organizationshealth care organizations

Recipients are expected to share information about Recipients are expected to share information about their successful performance strategies with other their successful performance strategies with other U.S. organizations.U.S. organizations.

Page 57: Compliance audit

THE MALCOLM BALDRIGE NATIONAL QUALITY AWARD

The Award is named for Malcolm The Award is named for Malcolm Baldrige, who served as Secretary Baldrige, who served as Secretary of Commerce from 1981 until his of Commerce from 1981 until his tragic death in a rodeo accident in tragic death in a rodeo accident in 1987. His managerial excellence 1987. His managerial excellence contributed to long-term contributed to long-term improvement in efficiency and improvement in efficiency and effectiveness of government.effectiveness of government.

Page 58: Compliance audit

THE MALCOLM BALDRIGE NATIONAL QUALITY AWARD

Baldrige Award Framework

4Information and analysis

3Customer andmarket focus

6Process

management

1Leadership

7Businessresults

2Strategic planning

5HR develop. &management

Customer and Market Focused Strategy and Action Plans

Page 59: Compliance audit

QUALITY IMPROVEMENT: THE JAPANESE WAY

Deming PrizeDeming Prize• The Deming Prize for quality was The Deming Prize for quality was

established in 1951 by the Japanese established in 1951 by the Japanese Union of Scientists and Engineers Union of Scientists and Engineers (JUSE).(JUSE).

• The Deming Prize is much more The Deming Prize is much more focused on processes than is the focused on processes than is the Baldrige.Baldrige.

The Japanese approach is based on an ethic of consistency and

emphasis on reduction of waste.

Page 60: Compliance audit

WHAT IS THE DEMING PRIZE?

The Deming Application PrizeThe Deming Application Prize Given to companies or divisions of companies that have achieved Given to companies or divisions of companies that have achieved distinctive performance improvement through the application of distinctive performance improvement through the application of TQM in a designated year. TQM in a designated year.

The Deming Prize for IndividualsThe Deming Prize for IndividualsGiven to individuals who have made outstanding contributions to Given to individuals who have made outstanding contributions to the study of TQM or statistical methods used for TQM, or the study of TQM or statistical methods used for TQM, or individuals who have made outstanding contributions in the individuals who have made outstanding contributions in the dissemination of TQM.dissemination of TQM.

The Quality Control Award for Operations The Quality Control Award for Operations Business UnitsBusiness UnitsGiven to operations business units of a company that have Given to operations business units of a company that have achieved distinctive performance improvement through the achieved distinctive performance improvement through the application of quality control/management in the pursuit of TQM application of quality control/management in the pursuit of TQM in a designated year.in a designated year.

Page 61: Compliance audit

OTHER JAPANESE CONTRIBUTIONS TO QUALITY THOUGHT

Lean Manufacturing (Toyota Lean Manufacturing (Toyota Production System)Production System)• Lean is a method of systematically Lean is a method of systematically

eliminating waste in a production system.eliminating waste in a production system.• Lean dramatically reduces cycle time.Lean dramatically reduces cycle time.• Lean focuses on the company’s “value Lean focuses on the company’s “value

stream” to identify wasted movement, stream” to identify wasted movement, wasted time, wasted inventory, and wasted wasted time, wasted inventory, and wasted space.space.

• Lean has been adopted by many US Lean has been adopted by many US manufacturers and other firms and has aided manufacturers and other firms and has aided them in achieving dramatic improvements in them in achieving dramatic improvements in operationsoperations

Page 62: Compliance audit

OTHER JAPANESE CONTRIBUTIONS TO QUALITY THOUGHT - 5 S’S

Other Japanese Contributions to Quality Other Japanese Contributions to Quality (cont.)(cont.)• The Five S’s. The five Ss are a sequential The Five S’s. The five Ss are a sequential

process that companies follow to literally “clean process that companies follow to literally “clean up their acts.” The Ss are:up their acts.” The Ss are:

Seri (Seri (SortSort): organizing by getting rid of the ): organizing by getting rid of the unnecessary.unnecessary.

Seiton (Seiton (set in orderset in order): neatness that is ): neatness that is achieved by straightening offices and work achieved by straightening offices and work areas.areas.

Siso (Siso (ShineShine): cleaning plant and equipment to ): cleaning plant and equipment to eliminate dirtiness that can hide or obscure eliminate dirtiness that can hide or obscure problems.problems.

Seiketsu (Seiketsu (StandardizeStandardize): standardizing ): standardizing locations for tools and other materials.locations for tools and other materials.

Shetsuke (Shetsuke (SustainSustain): discipline in maintaining ): discipline in maintaining the prior four the prior four Ss.Ss.

Page 63: Compliance audit

OTHER JAPANESE CONTRIBUTIONS TO QUALITY THOUGHT

Other Japanese Contributions to Other Japanese Contributions to Quality (cont.)Quality (cont.)• Quality CirclesQuality Circles

Are natural work teams made up of Are natural work teams made up of workers that are empowered to improve workers that are empowered to improve processes they use.processes they use.

• Total Productive Maintenance (TPM)Total Productive Maintenance (TPM) The idea behind this concept is that the The idea behind this concept is that the

worst condition a machine should ever worst condition a machine should ever by is on the day you purchase it.by is on the day you purchase it.

Page 64: Compliance audit

SHINGO PRIZE FOR EXCELLENCE IN MANUFACTURING

Named for Japanese industrial engineerNamed for Japanese industrial engineer Shigeo ShingoShigeo Shingo who distinguished himself as who distinguished himself as one of the world’s leading experts in one of the world’s leading experts in improving manufacturing processes.improving manufacturing processes.

The Prize was established in 1988 to The Prize was established in 1988 to promote awareness of Lean manufacturing promote awareness of Lean manufacturing conceptsconcepts

Recognizes companies in the United States, Recognizes companies in the United States, Canada, and Mexico that achieve world-Canada, and Mexico that achieve world-class manufacturing status. class manufacturing status.

Page 65: Compliance audit

SHINGO PRIZE FOR EXCELLENCE IN MANUFACTURING

The Shingo Prize recognizes organizations and The Shingo Prize recognizes organizations and research that is consistent with itsresearch that is consistent with its mission mission and modeland model with two types of prizes: with two types of prizes:

Business PrizeBusiness Prize—promotes use of world-—promotes use of world-class manufacturing strategies and class manufacturing strategies and practices to achieve world-class results. practices to achieve world-class results.

Research PrizeResearch Prize—promotes research and —promotes research and writing regarding new knowledge and writing regarding new knowledge and understanding of manufacturing understanding of manufacturing processes.processes.

Business Week referred to the Shingo Prize as Business Week referred to the Shingo Prize as the the “Nobel prize of manufacturing,” “Nobel prize of manufacturing,” because because it establishes the standard for world-class it establishes the standard for world-class excellence.excellence.

Page 66: Compliance audit

QUALITY IMPROVEMENT: THE EUROPEAN WAY

The The ISO 14000ISO 14000 family is primarily family is primarily concerned with concerned with "environmental "environmental management"management".. This means what the This means what the organization does to:organization does to:

• minimize harmful effects on the minimize harmful effects on the environment caused by its activities, environment caused by its activities, and toand to

• achieve continual improvement of achieve continual improvement of its environmental performanceits environmental performance..

Page 67: Compliance audit

ISO 9000 and 14000ISO 9000 and 14000 ISO 9000 and ISO 14000 are known asISO 9000 and ISO 14000 are known as

generic management system standardsgeneric management system standards..

GenericGeneric means that the same standards can be applied to means that the same standards can be applied to any organization, large or small, whatever its product - any organization, large or small, whatever its product - including whether its "product" is actually a service - in any including whether its "product" is actually a service - in any sector of activity, and whether it is a business enterprise, a sector of activity, and whether it is a business enterprise, a public administration, or a government department.public administration, or a government department.

Management systemManagement system refers to what the organization does refers to what the organization does to manage its processes, or activities in order that the to manage its processes, or activities in order that the products or services that it produces meet the objectives it products or services that it produces meet the objectives it has set itself, such as the following:has set itself, such as the following:

satisfying the satisfying the customer's quality customer's quality requirementsrequirements, ,

complying to complying to regulationsregulations, or , or

meeting meeting environmental objectivesenvironmental objectives. .

Page 68: Compliance audit

EUROPEAN QUALITY AWARD

European Foundation for Quality European Foundation for Quality Management (EFQM) was founded in 1988 Management (EFQM) was founded in 1988 by the Presidents of 14 major European by the Presidents of 14 major European companiescompanies

First European Quality Award issued in 1992 First European Quality Award issued in 1992 Endorsed by the EU CommissionEndorsed by the EU Commission Network has more than 700 membersNetwork has more than 700 members Formed the European framework for quality Formed the European framework for quality

improvement along the lines of the Malcolm improvement along the lines of the Malcolm Baldrige Model in the USA and the Deming Baldrige Model in the USA and the Deming Prize in Japan. Prize in Japan.

6868

The Europeans have adopted broad standards that can be adapted to the diverse nation

states of the EC.

Page 69: Compliance audit

EUROPEAN QUALITY AWARD Prize Winner categories consist Prize Winner categories consist

of :of : Leadership and constancy of purpose Leadership and constancy of purpose

Customer focus Customer focus

Corporate social responsibility Corporate social responsibility

People development and involvement People development and involvement

Results orientation Results orientation

Management by processes and facts Management by processes and facts

Continuous learning, innovation and Continuous learning, innovation and improvement improvement

Partnership development Partnership development

Page 70: Compliance audit

CONTRIBUTIONS OF VARIOUS DISCIPLINES

FinanceFinance: Measuring the cost of poor quality: Measuring the cost of poor quality Industrial EngineeringIndustrial Engineering: Design of : Design of

integrated systems, measurement, problem integrated systems, measurement, problem solving, work analysissolving, work analysis

Information TechnologyInformation Technology: Measurement, : Measurement, analysis, and reporting on qualityanalysis, and reporting on quality

Marketing ResearchMarketing Research: Competitive : Competitive standing on quality, understanding standing on quality, understanding customer desirescustomer desires

Operations ManagementOperations Management: Management : Management of integrated systemsof integrated systems

Page 71: Compliance audit

CONTRIBUTIONS OF VARIOUS DISCIPLINES (CONT’D)

Operations researchOperations research: : Analyzing product design Analyzing product design alternatives for optimizationalternatives for optimization

Organizational BehaviorOrganizational Behavior: : Understanding quality culture, Understanding quality culture, making teams effective.making teams effective.

Organizational EffectivenessOrganizational Effectiveness: : Satisfying the needs of both Satisfying the needs of both internal and external customers.internal and external customers.

Page 72: Compliance audit

CONTRIBUTIONS OF VARIOUS DISCIPLINES (CONT’D)

Strategic PlanningStrategic Planning: Quality as a means of : Quality as a means of achieving a unique competitive advantage.achieving a unique competitive advantage.

Systems EngineeringSystems Engineering: Translating : Translating customer needs into product features and customer needs into product features and process featuresprocess features

Value EngineeringValue Engineering: Analysis of essential : Analysis of essential functions needed by customer to find the functions needed by customer to find the lowest cost way of providing these functions lowest cost way of providing these functions that meet quality, reliability, and that meet quality, reliability, and performance requirements.performance requirements.

Page 73: Compliance audit

SYSTEMS DYNAMICS

Most process improvement efforts rely on Most process improvement efforts rely on breaking problems down into smaller, more breaking problems down into smaller, more manageable, components. manageable, components.

This “reductionist” approach sometimes This “reductionist” approach sometimes fails to recognize that the problem is fails to recognize that the problem is greater than the sum of its parts. greater than the sum of its parts.

A “systems thinking” approach to identify A “systems thinking” approach to identify interactions between activities and the interactions between activities and the unintended consequences that can arise unintended consequences that can arise from well-intended corrective actions. from well-intended corrective actions.

Page 74: Compliance audit

HOW SD CAN FACILITATE THE IMPROVEMENT EFFORTS

SD provides a visual model of SD provides a visual model of the system under study.the system under study.

Changes to the system can be Changes to the system can be made easily and quickly made easily and quickly analyzedanalyzed

Repeated iteration of a SD model Repeated iteration of a SD model can optimize the system under can optimize the system under studystudy

Page 75: Compliance audit

APPROACH FOR QUALITY IMPROVEMENT PROJECTS

Get a championGet a champion Prove the needProve the need Identify ProjectsIdentify Projects Organize teamsOrganize teams Perform the studyPerform the study Document recommendationsDocument recommendations Perform a pilot projectPerform a pilot project Document resultsDocument results Expand to entire organizationExpand to entire organization

Page 76: Compliance audit

CARRYING OUT THE PROJECT

Verify project need and missionVerify project need and mission Diagnose the causesDiagnose the causes Provide a remedy and prove its Provide a remedy and prove its

effectivenesseffectiveness Deal with resistance to changeDeal with resistance to change Institute controls to hold the Institute controls to hold the

gainsgains

Page 77: Compliance audit

INTRO TO SIX SIGMA

Six Sigma Capability: Extremely Six Sigma Capability: Extremely small variation in the process small variation in the process mean compared to the range of mean compared to the range of the specification limits.the specification limits.

Even if process mean shifts by Even if process mean shifts by 1.5 sigma => no more than 3.4 1.5 sigma => no more than 3.4 parts per million fall out of the parts per million fall out of the specification limit.specification limit.

Key focus: Y=f(XKey focus: Y=f(X11…X…Xnn))

Page 78: Compliance audit

BREAKTHROUGH IMPROVEMENT Verify the project need (Six Verify the project need (Six

DefineDefine)) Diagnose the Causes (Six Diagnose the Causes (Six MeasureMeasure

and and AnalyzeAnalyze)) Provide a remedy and prove its Provide a remedy and prove its

effectiveness (Six effectiveness (Six ImproveImprove)) Deal with resistance to Change (Six Deal with resistance to Change (Six

ImproveImprove)) Institute controls to hold the gains Institute controls to hold the gains

(Six (Six ControlControl))

Page 79: Compliance audit

Define the

Problem

Define the

Problem

MeasureMeasure

AnalyzeAnalyze

ImproveImprove

ControlControl

End

A) Identify what the customer wants. B) Organize an improvement team. C) Create a process flow chart - (SIPOC)

A) Identify what the customer wants. B) Organize an improvement team. C) Create a process flow chart - (SIPOC)

A) Select “Critical to Quality Characteristic” metrics. B) Define Performance Standards. C) Validate the measurement System. D) Establish baseline performance in terms of Sigma

Capability - Defects per Million Opportunities.

A) Select “Critical to Quality Characteristic” metrics. B) Define Performance Standards. C) Validate the measurement System. D) Establish baseline performance in terms of Sigma

Capability - Defects per Million Opportunities.

A) Identify significant characteristics and establish process capability.

B) Define performance targets for significant characteristics.

C) Identify root cause of process variation.

A) Identify significant characteristics and establish process capability.

B) Define performance targets for significant characteristics.

C) Identify root cause of process variation. A) Identify and evaluate potential solutions. B) Implement short-term countermeasures. C) Implement long term corrective actions. D) Identify systemic indirect effects and unintended

consequences of improvement ideas. E) Establish operating tolerances for new process.

A) Identify and evaluate potential solutions. B) Implement short-term countermeasures. C) Implement long term corrective actions. D) Identify systemic indirect effects and unintended

consequences of improvement ideas. E) Establish operating tolerances for new process.

A) Verify corrective actions and validate new measurement systems.

B) Determine process capability. C) Establish and implement control plan.

A) Verify corrective actions and validate new measurement systems.

B) Determine process capability. C) Establish and implement control plan. Move on to next highest priority process. Move on to next highest priority process.

SIX SIGMA PROCESS

Page 80: Compliance audit

VALUE ENGINEERING

Value Engineering (VE) is an intensive, Value Engineering (VE) is an intensive, interdisciplinaryinterdisciplinary problem solving activity that problem solving activity that focuses on focuses on improving the valueimproving the value of the of the functions that are required to accomplish the functions that are required to accomplish the goal, or objective of any product, process, goal, or objective of any product, process, service, or organization.service, or organization.

VALUE METHODOLOGYVALUE METHODOLOGY“The systematic application of “The systematic application of recognized recognized techniquestechniques which which identify the functionsidentify the functions of of the product or service, establish the the product or service, establish the worthworth of of those functions, and provide the necessary those functions, and provide the necessary functions to functions to meetmeet the required performance the required performance at the lowest overall cost.” at the lowest overall cost.”

**John M. Bryant, John M. Bryant, VM StandardVM Standard, Society of American Value Engineers, Oct. 1998, Society of American Value Engineers, Oct. 1998

Page 81: Compliance audit

VALUE ENGINEERING/VALUE ANALYSIS - WHY IS IT IMPORTANT?

Last 3 years, 2.7 million manufacturing Last 3 years, 2.7 million manufacturing jobs left the U.S.jobs left the U.S.

The U.S. is loosing the battle to foreign The U.S. is loosing the battle to foreign competition.competition.

Labor costs $12 to $30 per hour in U.S., Labor costs $12 to $30 per hour in U.S., less than $1 elsewhere.less than $1 elsewhere.

Fewer and fewer people will be required Fewer and fewer people will be required to produce the world’s goods.to produce the world’s goods.

Lean and Six Sigma alone are not Lean and Six Sigma alone are not enough!enough!

Page 82: Compliance audit

COMPETITIVE ADVANTAGE

Quality is defined as “conformance to specification.”

Value is defined as:Function

Cost You can’t have one without the

other! Competitive Advantage = Quality

+ Value

Page 83: Compliance audit

SIX STEP VALUE ENGINEERING JOB PLAN

8383

Information Phase

Information Phase

Creativity Phase

Creativity Phase

Evaluation Phase

Evaluation Phase

Planning Phase

Planning Phase

Reporting Phase

Reporting Phase

Implementation PhaseImplementation Phase

Clearly identify the problem(s) to be solved, and gather information on the background, functions and requirements of the product, process, or system.

Clearly identify the problem(s) to be solved, and gather information on the background, functions and requirements of the product, process, or system.

Brainstorm ideas on how to improve the high cost, broken, or inadequately performed key functions.

Brainstorm ideas on how to improve the high cost, broken, or inadequately performed key functions.

Screen ideas for acceptance, score remaining ideas on a scale and group ideas into categories. Develop design scenarios, and selection criteria. Rate and rank ideas.

Screen ideas for acceptance, score remaining ideas on a scale and group ideas into categories. Develop design scenarios, and selection criteria. Rate and rank ideas.

Plan how to sell ideas to management, identify key recommendations, plan management presentation.

Plan how to sell ideas to management, identify key recommendations, plan management presentation.

Give oral presentation to management, or develop written report.

Give oral presentation to management, or develop written report.

Get management approval for go-ahead, make management plan, make assignments, implement, follow-up.

Get management approval for go-ahead, make management plan, make assignments, implement, follow-up.

Page 84: Compliance audit

Mapping VE to 6Mapping VE to 6

Information Phase

Information Phase

Creativity Phase

Creativity Phase

Evaluation Phase

Evaluation Phase

Planning PhasePlanning Phase

Reporting Phase

Reporting Phase

Implementation Phase

Implementation Phase

Define the ProblemDefine the Problem

MeasureMeasure

AnalyzeAnalyze

ImproveImprove

ControlControl

VA/VE 6

Page 85: Compliance audit

SPORADIC V.S. CHRONIC PROBLEMS

Sporadic problems are dramatic Sporadic problems are dramatic and require immediate attention.and require immediate attention.

Chronic problems are not Chronic problems are not dramatic, they occur over a long dramatic, they occur over a long period of time.period of time.

Chronic problems are difficult to Chronic problems are difficult to solve.solve.

Chronic problems are “accepted Chronic problems are “accepted as inevitable.”as inevitable.”

Page 86: Compliance audit

SPORADIC V.S. CHRONIC PROBLEMS

Sporadic problems are solved by Sporadic problems are solved by fixing the control process.fixing the control process.

Chronic problems are solved using Chronic problems are solved using process improvement techniques process improvement techniques such as Value Engineering and/or Six such as Value Engineering and/or Six Sigma.Sigma.

Value Engineering may be applied to Value Engineering may be applied to sporadic problems as well, e.g., sporadic problems as well, e.g., Boeing 737/757 elevator feel Boeing 737/757 elevator feel computer problem.computer problem.

Page 87: Compliance audit

SPORADIC AND CHRONIC QUALITY PROBLEMS

Loss d

ue t

o d

efe

cts

Time

Sporadic departure from historic level

Historic level

Improved level

The difference between historic and improved levels is caused by a chronic disease that can be eliminated economically through process improvement techniques.

Page 88: Compliance audit

FOR MORE INFORMATION

On the Malcolm Baldridge National Quality Award, visit:http://www.quality.nist.gov/

For more information on the Deming Prize visit:http://www.deming.org/d

For more information on the Shigo Prize visit:http://www.shingoprize.org/AboutUs/default.htm

http://www.partnersusu.org/

For more information on the ISO 9000 and ISO 14000 visit: http://www.iso.ch/iso/en/iso9000-14000/index.html

For more information on the European Quality Award visit:http://www.efqm.org/model_awards/eqa/intro.asp

Page 89: Compliance audit