Audit
Programs
AuditNet Links
AuditNet Library
Sarbanes-Oxley
Page
AuditNet
Newsletter
Ask
the Auditor
Audit
Jobs
Partner
Discounts
Search the Site
Our
Sponsors
Advertise
Sign
the Guestbook
AuditNet
Home Page
AuditNet Policies and Procedures Update
by Rose Hightower
Thank you to all who have shown support of the policyguru. In order to better serve you, when asking questions, please identify the company or type of industry and process you are referring to.
Questions are still coming in about how to get started. The policy statement is often the most difficult aspect to determine. I find that unless the policy is driving the process, it is better to begin with the process, representing the current state.
When developing a policy and procedure document, having a flowchart of the process or a process description is a good place to start. Often the process will help you determine what the policy statement should be.
A process is a definable, repeatable, predictable, measurable set
of activities or tasks that produce work or navigate work through the
“system”. A systematic view that includes
• a plan (i.e., performing the tasks with purpose, not by accident),
• execution or implementing the tasks and choosing milestones where
decisions are required, and
• analysis where data becomes information and information becomes courses of
action for the next go around of the process.
A process description should begin with the triggers to target input requirements. Ask yourself what criteria or situation prompts the beginning of this process. Spend some time with the triggers, criteria and the situation. Ensure there is a direct cause and effect on the process.
In developing process descriptions, you don’t have to get too detailed. I try to define processes using one page and about a dozen steps. You have to work to keep it simple. This will help you to focus your thoughts and keep the procedure succinct. In writing the steps, refer to the flowchart often.
Simple process flowcharts should include only a few design elements.
• Square boxes represent process areas; since this box structure represents
work, define square boxes using verbs
• Diamond shape boxes represent decision junctions; word this box in the
form of a close-ended question and remember to address yes and no decision
outcomes
• Database icons to represent stored information to highlight information
access and flow
Once you are happy with the process flow, step back and take a look. What do you want to tell your employees about the process? That should be the basis for the policy statement.
Another hint – each handoff (i.e., movement from one box to another) is an opportunity for an internal control or measurement point.
