And make your organization stronger, at the same time
No matter how prepared you may feel with your finance organization going into an audit period, you still always feel the need to stock your office cabinet with a bottle of extra strength pain reliever for the inevitable headaches, and long evenings ahead of yourself that week. It’s inevitable; some account won’t reconcile, a report will drill into detail you and/or your team can’t explain and the system will fail right at that moment you need to reproduce a procedure. Or the most likely scenario, your cross-functional counterparts over in Sales and Marketing or National Accounts or Contracting will take advantage of that last-minute deal on the internet and are on a flight to Key West by now, leaving you with a big audit agenda, and little audit help. After all, who gets reception in Southern Florida? Especially when it comes to questions about a price you gave a small wholesaler a year and a half ago that you didn’t realize never made its way to the Finance Exec’s desk to approve, let alone accrue or forecast for.
So yes, back to the idea of prepared; you thought this was covered by sending the audit dates and times and agendas and areas of accountability out to your internal business partners, because who isn’t as diligent as you, Mr./Ms. CFO? Everyone else has probably pulled together all of the reports you’ve asked for, double checked the numbers, pulled contracts to back up selected transactions and planned a big breakfast for the morning they get to meet the auditors in the office on their first morning of the week….right?
OK, joking aside. In my time working through many audits with various Pharma financial organizations and various external audit companies, I have found a few, fairly easy exercises that you can implement within your organization that will help. What you’ll find too, is that these exercises, when done properly and frequently, will not only help assist in periods of audit, but will help hugely during periods of technology integrations, implementations, etc. It’s as close to Business Process Mapping and Internal Control Management ‘for Dummies,’ as I can get.
1. Create and Maintain E2E Test Case Scenarios
It’s the cliff notes of Business Process Mapping, yes. And for me, someone who really appreciates the art of such, it is difficult to promote the short cut; but for this purpose, it works. Sit down with your entire GTN organization and list out all E2E business processes. Now, depending on the level of cross-functional understanding of your team members, this may not be as easy as it seems. If you get the notion, or are just plain ‘in-the-know’ of functional silos in your organization, just ask each team member to briefly break out what they are responsible for day-to-day, monthly, annually, etc. It may take a little more digging and detective work to put together the whole picture, but believe me, once you do, not only will it help you speak to the auditors, but it will give you a better understanding of the big picture. And one other thing…don’t forget to ask IT for their weigh-in; many times, a break will exist in an E2E process due to IT batches, background jobs, etc. that the business treats the same way they do the light in their offices…they know it works when they flip the switch, but no clue on how (or what to do when it breaks!) Once you have these scenarios pulled together, test them out like you would a test case in a system implementation: Shadow an actual Production invoice process, or charge back accrual, or rebate payment. Or, if you have the resources available, tap into your Test environments and run an actual test cycle.
Goal here: break it, before the auditors do. Oh, and be able to speak to your multi-million (billion) dollar systems and business processes.
2. Document and Control Manual, Out-of-System Processes, Data
Guaranteed that you don’t have every process, dataset or report automated in a system and documented; if you do, you’re probably not reading this article. Let me be the first to tell you: it’s OK. What you do need to do though, not only for this pending audit, but for bringing soundness, integrity and compliance to your business, is to properly document and control these processes and datasets. It is a known fact that many companies, even big Pharma companies, rely on spreadsheets alone for many aspects of their GTN functions; and in many cases, ‘if it ain’t broke…’ But, while it may work for your organization at the time, you could still be putting your revenue and even brand equity at risk. And you know we aren’t talking peanuts here in these spreadsheets. We are talking millions and potentially billions of dollars in GTN-related activities being managed in these spreadsheets, or databases even.
Again, what must be done first is to take an inventory of these said reports or manual processes. They need to be documented, not only the process itself, but the reconciliation for each to related GL accounts, etc. Owners of each need to be identified and held accountable (and for this audit, be reachable in the case of questions on the process). Calculations need to be reviewed and understood by all parties; no hard-coding calculated values! Bridge schedules and commentary need to be linked where applicable. Change and version control needs to be place for each, as well as back-up/saving methods.
Goal here: prove your due diligence and compliance, show that you are running your business processes, not letting them run you.
3. Educate your Cross-functional Team on how they are Inputs to your Outcomes (that are being audited)
Yes, this is part of a larger conversation. This is something I preach on many GTN topics. But it is ‘super-true’ here, when it comes to audit. If team members are practicing awareness in their upstream business processes, they will be more apt to ask questions throughout the year, like an auditor would. i.e., If I process this rebate with no units associated, because I don’t have the information from the customer, what affect will this have on downstream data, like AMP calculations for example? If I am inputting an accrual rate into the system a date after it is effective, do I need to notify Finance to allow them to account for any missed accrual dollars, calculate an adjustment, etc.
This allows you to prepare for an audit all year long. But not only does it do that, it helps you be the organization the auditors want you to be (and you want you to be!)
Goal here: Be THAT organization!