KnowledgeLeader Blog

    Do You Have Adequate Documentation for Your Business Processes?

    Posted by Protiviti KnowledgeLeader on Fri, Oct 27, 2017 @ 07:07 AM

    ""Good process documentation doesn’t just describe how things work—it tells a story of an organization’s modus operandi (MO). As with any storytelling, it’s possible you might sit down to document your process and encounter writer’s block. There it is, the dreaded blank page taunting you as you struggle to decide how to get started.

    In fiction writing, probably the worst thing you can do is write from a template. In process documentation, though, it’s a great idea. Luckily, we’re happy to help you get started!

    A good process document narrative should contain certain touchpoints and key elements and well-thought out and properly placed visual elements. Ensuring that these elements are present will go a long way to reducing misunderstandings that always come up in verbal communications. It can also help to clarify each stakeholder’s considerations in the beginning. Once in place, a good process narrative is also an excellent tool to communicate processes to other departments, training new staff and even just as a reminder when differences arise.

    Our Process Documentation Narrative and Flow Chart Guide includes more than 90 questions to consider when creating a process narrative and flow chart, separated into the following sections:

    • Process Summary
    • Process Maps
    • Information Technology
    • Risk Checklist
    • Controls Checklist
    • Additional Considerations

    This is probably the best first step in writing good process documentation so that you can decide what narratives are needed. Though you might initially think the components are obvious, it can sometimes be difficult to consciously remember all of the aspects of the work you do every day, or deciding which of those aspects need to be documented.

    The second step is to consider your audience. Is this just for internal training, or is it part of or linked to the Committee of Sponsoring Organizations (COSO) Integrated Internal Control Framework? For example, the control elements of completeness, accuracy, authorization, safeguarding of assets, and rights/obligations, etc. should be incorporated into processing activities. It may not be critical to include reference to the COSO control elements, but the audit team should be mindful that the underlying internal controls incorporated into the processes being documented mitigate the associated risk of financial statement misstatement and ensure consistency with GAAP.

    Typically, creating this type of documentation is a reiterative process that involves input from individuals at various levels of responsibility discussing processing steps, related documents and responsibilities, and process metrics or outputs.

    Together, the audit team must condense the process information into manageable narratives and process flows that incorporate all the key steps, processing responsibilities, documents and actions. Both manual and application-based activities should be included with a focus on key control points and outputs. These will include authorizations, supervisory review and controls configured in processing applications like access security, segregation of duties through restrictions to processing functionality, and transaction logs.

    So, do you have everything you need to begin your process documentation narrative? Check out these topic areas on KnowledgeLeader for more great guidance:



    Topics: Internal Audit, Process-Level Control, Document Retention

    Add a Comment:

    About KnowledgeLeader

    KnowledgeLeader, provided by Protiviti, is the premier resource for internal audit and risk management professionals.

    With over 1,400 customizable tools and 1,300 articles by industry experts, we offer the most comprehensive service on the market.

    For more information:

     Tour the Site

    Recent Posts

    Posts by Topic

    see all