Category: Insights

Operational Audits: Tool for Continuous Improvement

Managing operations of any kind, be it manufacturing, logistics or services, is getting tougher by the day. Considering unpredictable scenarios, volatile environment and numerous micro and macro factors impacting the operations, it is unfair to assume that managers & people will have a razor-sharp focus on operational efficiency and effectiveness. When the pressure mounts, people tend to take short-cuts and make their own informal procedures which could be detrimental in the long run.

It reminds me of a case when we had a temporary problem with a regular transporter and had to allow non-contracted transporters to ensure timely delivery to the customers. It meant higher cost and a risk of working with unknown carriers. However, even after the regular transporter resumed normal services, the delivery staff continued to use non-contracted transporters on some pretext or the other. It was discovered when one of the vehicles of one such transporter went missing along with the products.

Need for the Operational Audits

The purpose of an operational audit is to improve the efficiency of day-to-day operations as well as identify risks due to non-compliance to the set procedures & policies. The audits provide a feedback loop to the operational managers based on the assessment of the effectiveness of the processes. These are not same as the internal audits, conducted by the audit department once or twice every year. The operational audits must be carried out as frequently as deemed important. For example, for a laboratory in the pharma manufacturing unit the, 5S audits may be required at a weekly frequency whereas the Contamination audits may be done once every month. For a warehouse operation, the cost efficiency audits may be done once a quarter while the stock audits may be required every month.

Operational Audits are different from Internal Audits

Operational audit programs are much more in-depth than normal internal audits. They do not look at how things are, they also look at how things could be. In one of the examples of the warehouse audit, the auditor discovered that the pickers are travelling to the same area of warehouse multiple times during the observation period. On further investigation, it was found that the orders are being picked individually for each customer order. However, the back & forth movement of the pickers for each order was not only inflating the need for more manpower but also slowing down the operation. The auditor recommended the change in the picking method to batch picking which led significant reduction in picking time & cost. From an internal audit perspective, there was no gap in the process but from the operational audit perspective, there was a significant opportunity for improvement. That is where the operational audits distinguish from the internal audits.

Another important aspect of the operational audit is that the auditors can be from the same team or the operational excellence experts from within the organization.

We already have Metrics in place to monitor and improve performance, then why Operational Audits?

Metrics and performance indicators are the outcomes and by the time the problems translate into visible outcomes, it is often too late. The operational audits are proactive in nature and used to isolate the problems right at its inception. Much before it is big enough to show up in the performance metrics.

A simple example from daily life is effect of your eating habits on the weight. Even though you measure weight on daily basis it may take many days or months before it starts reflecting on the weighing scale. On the other hand, if you audit what you eat and take corrective actions on daily basis, you can be assured about the positive impact on the body weight.

Structuring the Operational Audit Program

A meaningful operational audit program needs to be well-structured and planned to deliver effective results. The steps involved are:

1. Prepare an Audit Plan:
   
   • Depending on the nature of operations, one needs to start with defining the key outcomes of the processes that are part of the operations. As mentioned in the examples above, for a lab operation, it is the maintain the hygiene and prevention of contamination that is critical, whereas for customer service operations, it is the accuracy and timeliness, apart from the cost that is important.
   • Decide whether all the outcomes can be clubbed in a single audit or divided into 2-3 different types of audits. The idea is not to make audit program too complex yet manageable. For example, for a warehouse audit the safety and compliance could be clubbed into one audit whereas the cost, service, and quality into another. Considering the higher risk associated with safety and compliance, it can be conducted more frequently as compared to the other audit.
   • A sample audit plan may look like:

   Operation	Audit Areas	Need for Audit	Frequency	Audit Responsibility
   Warehouse	SafetyCompliance	To fulfil the corporate policy of zero tolerance to safety and compliance	Monthly	Warehouse Manager
   Warehouse	CostQuality	To achieve the set cost & quality objectives	Quarterly	Regional Logistics Manager
   Warehouse	Hygiene / 5S	To prevent the contamination of product	Weekly	Warehouse Supervisor
   Customer Service	AccuracyQuality Cost	To reduce the number of errors and increase the customer satisfaction score	Quarterly	Operational Excellence Manager

2. Define Audit Criteria or Checklist:
   For each audit type, determine the reference or standard to be used for the assessment e.g. ISO standard or Risk & Control Matrix. If you don’t have one, it can be developed as below:
   • Map the key activities for each process involved. For example, in warehouse operation the key safety areas include the movement of vehicles in the yard, loading & unloading operations, use of material handling equipment and storage of products.
   • Now, assess the risk involved in each area and the controls that need to be in place to mitigate the risk. For example, the risk involved in the movement of vehicles in the yard is the accidents due to reckless or high-speed driving. The controls that need to be in place to mitigate the risk are putting a speed limit signboard, putting direction and markings for vehicular movement, installing convex mirrors at the sharp corners etc.
   • Include all the important control points as the audit checklist. For each checkpoint, add the related best practice document or pictures that act as a guidance for the auditor.

   Activity	Risk Involved	Risk Level	Control Measure	Guideline Document
   Moving Vehicles in the Yard	Accidents	High	Put Speed Signages Mark Directions for Vehicle Movement	Signage - Size and Placement Guideline

3. Implement the Audit Program:
   • The implementation requires communication with all the stakeholders and getting their buy-in. The stakeholders’ alignment becomes easier if the audit objectives are aligned to the business or functional objectives, as shown in the step 1.
   • It must be communicated that the purpose of the audits is to drive continuous improvement and not to find faults with the auditee
   • Select a suitable tool e.g. SIMSA, to minimize the manual efforts in managing the audit program
   • Train the personnel responsible for conducting the audit on the process as well as using the tool
   • Make a calendar of audits for each site, in agreement with the auditors and the auditees

   Audit Title	Site	Dates	Auditor
   Warehouse Safety & Compliance Audit	Site ABC	From dd/mm/yyyy to dd/mm/yyyy	John Smith
   	Site XYZ	From dd/mm/yyyy to dd/mm/yyyy	Jane Doe

4. Monitor the Audit Program:
   Any program not subjected to periodic monitoring and review is likely to fail and the audit program is no exception to it. The purpose of the audit program review is to ensure:
   • Whether the audits are happening as per the calendar?
   • Whether the reports are shared in a timely manner with all the stakeholders?
   • Whether there are corrective actions in place for all the observed gaps?
   • Whether the corrective actions are being closed in a timebound manner?

   Monitoring an audit program can become extremely cumbersome without a dedicated tool like, SIMSA, which can not only pull all the information on click of a button but also send automated reminders to people, should there be any backlogs. The visibility of the status of the audit programs instils the seriousness and accountability in the organization

5. Improving and refreshing the Audit Program:
   In a dynamic environment, it would be naïve to assume that the risks, controls and audit criteria once decided can be used for ever. As the business priorities change or there is a change in the risk profile or the nature of controls, the audit program must be altered to accommodate these changes. Also, if certain deficiencies were found in the previous audit program, the same should be rectified. This approach aligns with the PDCA (Plan-Do-Check-Act) framework of operational excellence.

Source: How to Conduct a Quality Internal Audit, Seetharam Kandarpa

Conclusion:

It is obvious that operational audit is one of the important levers of continuous improvement. Unlike internal audits, the operational audits are proactive in nature because the focus is not what is not right but what could be done better. However, it has been seen that in most organizations the operational audits are missing or done in an adhoc manner. Therefore, it does not translate into any visible improvements. A well structured operational audit program supported by technology like SIMSA, can be an important tool in the hands of operational managers to drive the operational excellence.

Suppliers are the key source of competitive advantage for any business. Your quality, efficiency and service delivery significantly depends on what kind of suppliers you have. Having selected a good and competent supplier doesn't guarantee a perfect partnership. Even the best suppliers can fail or falter depending on a situation. The classic case study of how Ericsson lost months of production due to fire in the microchip plant of Philips, highlights the importance of continuous engagement with your critical suppliers.

Supplier audits have been used as tested tool to ensure that the suppliers not only consistently deliver high-quality materials, ingredients or services but also taking steps to identify and mitigate future risks. Leveraged correctly, supplier audits can identify, address, and prevent problems in a supplier’s product quality or processes before the problems spread.

BENEFITS OF SUPPLIERS AUDITS

• Ensuring suppliers are complying and working to the industry standard, regulatory norms and professional ethics
• Identifying risks in your value chain before they become a problem and jointly working on the mitigation plan
• Helping your suppliers with guidance on development on critical areas and performance improvement
• Enhancing the communication between the manufacturer and supplier
• Improving your sourcing strategy and decisions

WHEN TO CONDUCT SUPPLIER AUDITS

Supplier audits is not a one time activity but has to follow a structured approach aligned to the sourcing strategy.However, there are certain stages of the supplier lifecycle management that definitely require the audit interventions, irrespective of any sector or business.

1. Introducing a new supplier:
   If you don't have a past experience of working with the supplier or don't have enough verified information about supplier in terms of quality, delivery, or service, & other aspects of performance, makes that supplier a risk for your business. If these risks are significant for the business, then the supplier must be audited by a cross-functional team consisting of procurement, quality, production and finance experts. The audit scope should cover all the areas e.g. quality, manufacturing process, compliance, financial analysis, supply chain, operations excellence. It would not only ensure that the supplier is fit to meet your business requirement but also identify the areas of future development and relationship.
2. Problem with an existing supplier:
   If an existing supplier is not performing to the desired level of expectation, a detailed audit may help to identify the root cause of the problems in the processes, human resource or technology. Sometimes, it is the lack of understanding of the requirement by the supplier of communication gaps between the manufacturer and supplier could be the cause of the problem. Such audits are highly focused on addressing specific problems and need not cover all the aspects of the supplier relationships.
3. Developing existing supplier for a new material or service:
   If you plan to develop your existing supplier for a new line of materials or services, an audit may help to identify the key areas of support required by the supplier. It also help to assess the readiness of the supplier to supply the new materials and potential risks associated e.g. the new equipment ordered by the supplier may get delayed or supplier's capacity may get constrained and impact the existing services.
4. A supplier is critical for your business continuity:
   Preventive audits are necessary if a supplier is critical to your business, for example, the supplier is highly regulated and would be shut down due to non compliance. Or, an incident at supplier's place can impact your production (Ericsson-Philips case study). Even if the critical supplier is performing well, the high risk and criticality of the supplier to your organisation means you must continuously assess its processes and other capabilities.

WHAT TO ASSESS IN SUPPLIER AUDITS

There is no "one size fits all" approach to supplier audits and each audit is driven by the objectives and risks under consideration. However, at broad level the areas covered under the audit are:

1. Risks Management:
   You would like to be assured of the supplier's process of identifying and mitigating risks in its value chain. The suppliers who have a business continuity plan in place and update it periodically are much more valuable than who don't. This area of audit becomes very critical if your dependence to the supplier is high and do not have alternatives. For example, in pharma industry it takes lot of time and cost to get regulatory approval for a supplier of a critical ingredient. The questions that must be answered are:
   • Whether the supplier has mapped its valued chain, identified the risks and assessed the impact on the business?
   • Has the supplier identified the potential disruptive events and got the disaster recovery plans in place? If yes, what is the time to recovery for each of the likely event?
   • How frequently the risk assessment is updated and if it is reasonable enough keeping in mind the changing environment?
2. Operational Processes:
   Audits should assess the processes & systems that are affecting the performance of the supplier and ensure action is being taken to address the gaps found. The processes involved are:
   • Quality Management
   • Manufacturing
   • Equipment Maintenance
   • Design & development of new products
   • Safety & Security
   • Inbound operations - procurement, receiving, storage, inventory management
   • Outbound operations - finished products storage, inventory management, dispatches
   • Customer service - order fulfilment, complaints management
   • Documentation

   The auditor need to assess whether there are SOPs defined for each process, if the SOPs are followed and the checks & controls implemented in the critical processes to detect any deviation.

3. Compliance:
   Compliance to the regulation and professional ethics is essential for the business continuity. The typical questions that must be answered are:
   • Has the supplier clearly identified the complete list of regulatory requirements that must be met?
   • What are the supplier’s internal processes to ensure those regulatory requirements are being addressed, maintained, and improved on?
   • Whether the roles and responsibilities are defined within the organisation for ensuring the compliances?
   • Whether there’s independence within the organisation to resolve any compliance or regulatory issues quickly by senior management and leadership?
   • Whether there’s an effective, robust process in place to add or update the existing regulatory requirements?
4. Performance Management:
   The focus on innovation, performance management and continuous improvement helps an organisation to become efficient and overcome business challenges. It is not just the supplier but you as a customer may get the benefit of their efficiency and innovation. As part of the audit, you may want to assess:
   • How does the supplier measure their performance on various aspects of business and operations?
   • What are the benchmark standards used for comparing the performance?
   • Which techniques of continuous improvement are used ?
   • What is the role & involvement of people at various levels in continuous improvement?
   • If there is a well structured innovation & product development process and how effective is the process?
5. IT Security:
   If you have shared your proprietary information, designs or technology with your supplier as part of the agreement, you may want to ensure that information is secured with the supplier. Therefore, you would have a periodic assessment of their IT policy; what security protocols have been implemented; how frequently vulnerability and penetration tests are conducted; how the gaps identified are closed. While the supplier may have signed a legal non-disclosure agreement, it may still make a sense to prevent such breaches at the first place rather than going through legal process.

STRUCTURING THE SUPPLIER AUDIT PROGRAM

A common failure in a supplier audit program is turning it into a paperwork exercise, listing all sorts of documentation and exercises in an audit report without much focus on the recommendations for improvement. As the resources required for conducting the supplier audits are limited, therefore, the approach adopted must be both effective and efficient. A risk based approach is recommended in identifying which suppliers have to be audited, how frequently to be audited and what is the expected outcome of each audit.

Given the risk profile of each supplier, some suppliers may be required to be audited at least once a year while others may be once in 2 or 3 years. The key steps required to structure the supplier audit program are:

1. Map all the suppliers and assess the criticality of each depending on your dependence a supplier and the potential impact of the supplier's failure on your business.
2. Prioritise and identify the suppliers for including in the supplier audit program.
3. Evaluate the past performance and issues of the suppliers and impact it had on your business.
4. Depending on the criticality of the material being sourced and past performance, determine the periodicity and scope of audit for each audit. Prepare a calendar of supplier audits.
5. Determine the criteria and standard ( e.g. ISO, OSHA) to be used for each audit.
6. Identify the audit resources required for conducting the audit and determine whether these have to be outsourced.
7. Prepare checklists covering the specific areas as determined in the scope of each audit. Remember, each checklist has to be tailored to the risks identified for each supplier.
8. Get the suppliers' buy-in and integrate them in the audit program.
9. Have a robust mechanism for planning corrective actions for the gaps identified in the audit and tracking of the deadlines for each action point.
10. Use a technology platform to manage the end to end audit workflow and provide complete visibility on the gaps and corrective actions to both you as a customer and the suppliers. The technology helps you to save time, efforts in putting together and tracking the information and it at the same time it ensures consistency throughout.

Conclusion:

The supplier audit is a strategic tool to identify and mitigate risks in your supply chain for business continuity planning. Given different nature of risks associated with each supplier, "one size fits all" approach does not work. Instead a risk based approach must be adopted to determine the scope and periodicity of audit for each supplier. Next, the buy-in and early involvement of the suppliers in the structured audit program is essential for the successful outcomes.

The conventional approach to Supply Chain Risks Management and Audits is inadequate to address the ever-changing risk profile of the entire value chain. The audits within the four walls of the organisation doesn’t present the true picture of all the risks the business is exposed to. In today’s connected and dynamic world, an integrated risk-based approach is required.

In the last few years, a number of businesses have been caught by surprise by unforeseen supply chain disruptions across industries ranging from pharmaceuticals & consumer goods to electronics & automotive. Even if we discount the year 2020 as an exception, according to BCI report 2019, about 42% of the companies surveyed experienced at least 1 to 5 supply chain incidents that led to significant disruptions in 12 months. The worrying fact was that almost 22% of the companies surveyed had no idea of what may have caused the disruption in their operations.

Supply Chain Disruptions

Almost 75% companies surveyed have faced at least one disruption in 12 months preceding Covid

The major impacts of the disruption, according to the report, are:

• Loss of Productivity (50.3%)
• Customer Complaints (41.5%)
• Increase in Cost of Working (39.9%)
• In Loss of Revenue (36.1%) mmm

The Covid pandemic has led to a greater divide – the business with proactive supply chain who rebounded much faster than the businesses with not so proactive supply chain. It has thrown the light on importance of supply chain risks management & business continuity planning for business sustainability. There has never been a greater need for supply chain transparency. Understanding the importance of governance, monitoring mechanism & visibility of controls effectiveness are necessary to mitigate risks in supply chain.

Sources of Supply Chain Risks

The sources and types of supply chain risks may vary a lot depending on each part of the value chain.

The key sources of the supply chain risks are the external environment and internal operations. The external risks e.g., acts of terrorism, critical labour stoppages and port closures, infectious diseases, and natural disasters, cause high levels of concern and are less controllable.

On the other hand, the internal operations risks that involve quality assurance, IT security and uptime, compliance with regulatory requirement, sustainability, health and safety, conflict minerals etc. are much more controllable. The occurrence and impact of internal operational events go unnoticed most of the time and therefore, offer a greater opportunity for improvement through better governance.

The supply chains are increasingly becoming vulnerable to risks. There are multiple factors contributing to the supply chain vulnerability e.g. globalization, outsourcing of operations, stringent regulatory compliance, higher workforce turnover, inadequate transparency & visibility etc.

Role Supply Chain Audits in Risk Management

Supply chain audits present an opportunity for the companies to look at the supply chain processes and operations to make sure they’re doing right things to control costs and mitigate risk factors. Conventionally, supply chains have been audited by the internal audit function – once or twice a year. Given the increasing uncertainty and increasing instances of disruptions, the traditional internal audit process is not sufficient to assess the effectiveness of risks mitigation controls.

The approach needed for the keep pace with changing risks involves:

1. Frequent updation of the Risks in the value chain:It may seem to be daunting task to keep a track of what has changed. Use of AI and ML technologies could be immense use to track events across the world can help to quickly update the risk profile of a supplier, contract manufacturer or supply network.
2. Prioritization of Risks:Given the complexity involved in tracking and mitigation of risks, the companies must identify high risk areas in the value chain that requires closer monitoring. The audits should focus on the risks that has higher likely impact on the business. As the confidence level on certain risk control measure grows, the priority may shift to the next in the order of risk level.
3. Frequent Audits:Audits should not be once in a year activity but be perpetual so that the gaps could be identified much earlier before they cause any disruption. Such audits have to be dovetailed into the operations e.g.
   • Daily Gemba walk in manufacturing plants and warehouses by the site managers
   • Monthly self-assessment by the site teams on the critical checkpoints
   • Use of technology for visibility and integrated workflow management based on the PDCA (Plan-Do-Check-Act) framework, that is quick to deploy and easy to use for the site teams.

   There are many audit tools available in the market, but most cater to the automation of the conventional internal audit process. This makes these tool too elaborate & complex with multiple level of reviews & approvals, and therefore, cannot be used for the periodic self-audits. SIMSA has broken the conventional thinking on the audits by making the technology available on mobile and does not have too many steps involved to schedule & conduct the audits followed by planning & tracking corrective actions.

4. Remote Audits and Real Time Audits:Covid had put restriction on conducting physical audits but, at the same time opened opportunities for the use of technologies for conducting remote audits. Also conducting perpetual audits across various supplier, third parties and manufacturing locations is practically not feasible with physical audits. While still at a nascent stage, the future lies in conducting audits using Augmented Reality and IoTs based data analytics for risk assessment.
5. Automation of Controls:Using the IT / control towers for monitoring the key drivers and triggering self-corrective actions may obviate the needs for the conventional.

Integrated approach to Supply Chain Risks and Audits

No supply chain audit program can be “internal” in the true sense. With increasing level of outsourcing, the involvement of the suppliers and third parties absolutely must for an audit program that really addresses the supply chain risks proactively. However, if each organization in the value chain follows a silo approach for the audits keeping in mind the organization specific objectives & risks, it may lead to sub-optimal results, duplication or missing out on certain areas.

An integrated approach to the audits, keeping in mind the overall objectives of the supply chain and risks in the extended value chain, is required for prioritization and scoping the extent of audits. Many procurement and logistics professionals (who deal with the 3rd parties) tend to take refuge in the contractual terms and liability clauses for certain risks, and therefore, follow the hands-off approach. One must realize that the financial penalties or liabilities may not compensate for the loss of image, reputation or customers’ confidence.

Given the spread and extant across geographies and organizations, no supply chain audit is “internal” in true sense. The outsourcing of operations doesn’t imply outsourcing of risks management.

Conclusion:

While supply chain risks are becoming greater headaches for everyone, it requires a different approach to manage risks. The conventional internal audit programs are inadequate to proactively identify, assess and mitigate risks, as the supply chain risks are dynamically changing. A perpetual, integrated and collaborative approach across the value chain, making use of modern technologies, is the need of the hour for effective supply chain risks management.