Maintaining Internal Controls in Dynamic and Distributed Business

Organizations operate in a field of risk landmines. The daily headlines reveal companies that fail in risk, compliance, and internal controls. Business today is complex in its operations and corresponding internal control obligations. Adding to the complexity of global business, today’s organization is dynamic and constantly changing. The modern organization changes by the minute. The business enters new markets, opens new facilities, contracts with agents, or introduces new products. New laws are introduced, regulations change, the risk environment shifts (e.g., economic, geo-political, and operational), impacting how business is conducted.

https://grc2020.com/2019/01/17/maintaining-internal-controls-in-dynamic-and-distributed-business/?mc_cid=e31dfe6202&mc_eid=76234b26d2

Quality Problems: Beyond Root Causes to 'Real Causes'

If a management system problem arises, then something has changed. It may be obvious what the change is or we may have to investigate and discover it. Discovery of the change and preventing it from happening again is the definition of the basic root cause analysis and corrective action plan we’ve often followed, or observed. However, this process isn’t broad enough to succeed in the actual job of preventing management system problems. One reason is that each root cause seems unique, so we never see a pattern or the bigger picture.

'Real Cause Analysis'

A revelation was discovering that Allan Sayle, in his book on management audits, not only had the same thought, but had taken his extensive experience and concluded there were only six real causes of management system problems(1). Further, Sayle also listed two or more specific items for each real cause that enabled an auditor or investigative manager to properly assign a real cause for a management system problem. This real cause then required real thought and real management to correct. After all, identifying a real cause is only helpful if we can come up with a change that eliminates or mitigates it.

Sayle’s Six Real Causes

First, let’s look at the six real causes and their specific associated items from Sayle’s book:

Lack of Organization

• Undetermined responsibilities and authorities
• Undefined management systems
• Inadequate communications

Lack of Training

• Inadequate schooling
• Inadequate company training

Lack of Discipline

• Example set by supervisors and managers
• Company-wide quality campaigns/culture
• Personal attributes
• Inflexible systems
• Demotivating environments

Lack of Resources

• Overly-complex management systems
• Irresponsible attitudes
• Unrealistic estimates
• Uneven allocation
• Inadequate reinvestment
• Failure to modernize

Lack of Time

• Overly complex systems
• Irresponsible attitudes
• Unrealistic commitments
• Selfishness
• Excessive workload

Lack of Top Management Support

• Attitude/motivation
• Management education
• Time management
• “Cancer of complacency”

Real Cause Investigation and Identification

A typical scenario: How would we decide what the real cause of the problem was, and what would we do as a result? The problem was temporarily cured without major organizational changes, so lack of organization isn’t it. People were not retrained to resolve the problem, so lack of training isn’t it, either. The problem did subside when there was extra effort and oversight by management, so lack of discipline seems likely. However, we need to be exhaustive in the analysis to ensure we’re correct. No changes to resources or time was made, so lack of resources and lack of time aren’t real causes. That leaves us to consider lack of top management support as a real cause. Top management deemed the problem important enough to deploy engineers and consultants, so that’s evidence of top management support, and it was related to disappearance of the problem, at least temporarily.

This is the point when having specific items associated with each real cause is useful. Under lack of discipline, there are five items. There wasn’t evidence that supervisors and managers were trying to “get it out the door,” so we can pass on that. There wasn’t any indication that the company culture related to quality was a contributor, thus personal attributes are probably not an issue. People don’t typically change, so the fact it took a year for the problem to recur seems to lessen the chance of personal attributes as a cause. Since no system changes were made inflexible systems is an unlikely item. We’re left with the demotivating environment, which does seem possible, especially since the plant personnel saw how much motivation was put in place when the engineering task force descended.

What about items in top management support? If top management doesn’t actively value quality, then its attitude could be de-motivating. Similarly, if top management is educated in operations and finance, but has no one familiar with management system and its contribution to the bottom line, that might be a trigger for management system problems. We earlier ruled out lack of time, so time management isn’t likely. The “cancer of complacency” is simply the attitude that we’ve always done it this way, and we’ve been successful, so no change is needed. This is an unlikely reason.

Thinning the Field

We’re left with two possible real causes related to motivation (because others recognize the importance of the work being done). If top management wants to motivate, upper management can become more involved and educated on the topic of management system, or they can participate in and visibly support management system whenever the opportunity arises. One of the companies I’ve worked with has a president who always participates fully and continuously in every internal audit and regulatory inspection, along with his management system and other personnel. The message he sends is clear, and everybody notices.

If management doesn’t regularly send a message that management system is important, there will be a slow loss of motivation in the people responsible for management system. This slow decline of motivation to do good work is a slow change that will create management system problems. However, because it doesn’t have an abrupt starting point, it’s difficult to detect. And if investigation causes the problem to disappear, as it did in the example already presented, we’ll find a root cause, but not a real cause.

The other five real causes of management system problems are also management responsibilities. Management’s job is to anticipate problems and prevent them. You can call this risk-based thinking or preventative action if you’re doing ISO 9001 or ISO 13485, but unless management does this, everything else is correction and corrective action without end.

Let’s start with lack of organization. Certainly it’s management’s job to define the organization. The U.S. Food and Drug Administration’s (FDA) Quality System Regulation (QSR) specifically states that organization is part of management responsibility. What about lack of training? Companies generally hire people who have education, background, training and experience to be competent. Additional training is usually needed so that people understand “how we do it around here.” Further training may be needed to keep personnel aware of new systems and requirements. Determining what training is needed and how to provide it effectively is management’s job. Is lack of discipline really a management issue? If immediate managers tell employees to speed it up by skipping established procedures, then discipline will suffer along with product quality. However, there may be individuals whose personal attributes lead them to ignore Standard Operating Procedures (SOPs) and do it their way. Supervisors and fellow employees are both responsible for detecting such behavior and taking appropriate action. How can this be prevented by management? The employee selection process must focus on detecting possible discipline problems by checking with prior employers or using probationary periods to evaluate new hires.

Lack of resources, whether personnel or equipment, is clearly a management responsibility. The QSR specifically calls out providing adequate resources as a management responsibility, along with assigning responsibility and authority. Lack of time is different from lack of resources because time cannot be purchased, but must be allocated through planning based on management experience. Efforts to double production speed by doubling production personnel usually fails. Many processes have fixed cycle times and trying to reduce them can lead to major quality issues. The lack of top management support has already been discussed; clearly, it is the responsibility of top management to provide support and guidance to employees and their functions in resolving management system issues.

Conclusion

Finding root causes of management system problems is not the same as finding real causes of management system problems. The root cause is merely objective evidence while the real cause is the finding or non conformance. Taking the time and effort to find real causes and correct them will reduce the occurrence of management system problems, and the need for more correction action and preventative actions (CAPAs) and root cause determinations.

References

1. Sayle, Allan. “Management Audits: The Assessment of Quality Management Systems.” 1988. McGraw-Hill. 396 pages

This article was adapted from the one published by David Manalan, founder of INQC Consulting, who has over 50 years of experience with companies regulated by FDA, EPA, OSHA and similar agencies.