Case Study: Auditing With Process Mining — Part X: Data Analysis Results
This is the 10th article in our case study series on auditing with process mining. The series is written by Jasmine Handler and Andreas Preslmayr from the City of Vienna. You can find an overview of all the articles in the series here.
The data analysis results summarized the answers to the analysis questions and were the basis for our audit report, including the findings and recommendations.
Figure 16 shows that we could answer all our questions. Only questions No. 1 and No. 12 could not completely be answered because on the one hand we had some blind spots in the process due to a lack of data and on the other hand we had to simplify the process considerably to deal with its complexity. Therefore, we set their status to yellow.
Figure 16: All our analysis questions could be answered
Within the explorative analysis, we discovered that in 2019 approximately 1% of all orders were canceled. In addition, for 1.4% of all cases, an order was placed in the information system, but no further activities were recorded. These cases appeared to be canceled as well, but the cancellation was not documented in the information system. While the total percentage of canceled orders was in a normal range, we identified a potential for improvement regarding the documentation of canceled cases.
Furthermore, we found that ca. 7% of all cases started with an invoice recording (the corresponding order was only placed later). These cases indicated that the formal procurement process was not always observed. Instead, some employees made purchases without prior authorization, an undesirable behavior called ‘Maverick Buying.’
Within the targeted analysis, we had realized that 17% of all invoiced orders were not released. However, this irregularity was tolerable because they all belonged to the product group office supplies, which did not require an order release activity.
The procurement guidelines of the audited party also required that all orders with an order value of more than 20,000 EUR had to be released following the four-eyes-principle. Our analysis showed that, except for one case, the four-eyes-principle was observed whenever the order value of 20,000 EUR was exceeded. In this one case, a two-staged release was documented in the information system, but one person was not entitled to release an order of this value. This deviation from the defined release process indicated that there might be a weakness in the internal control system. Therefore, we recommended that the release permissions should be evaluated on a regular basis.
Regarding invoice processing, the procurement guidelines demanded that all invoices be checked before payment. Our process mining analysis showed that these checks were not consistently documented in the information system. Thus, it was not transparent if the necessary checks were performed before payment.
In addition, a four-eyes-principle was mandatory during invoice release whenever the invoiced sum deviated more than 10% or 1,000 EUR from the order value. In individual cases, this four-eyes-principle was not followed. Therefore, we recommended that further control measures needed to be implemented to ensure that all invoices were checked properly before they were released for the final payment.
Furthermore, our process mining analysis showed that approximately half of all invoices were immediately due for payment, although the general payment target was set to 30 days after receiving an invoice. Thus, there was potential improvement regarding the documentation of payment targets.
Finally, the payment target was not observed in approximately 6% of all cases. The audited party reasoned that, in some cases, there was still a need for clarification regarding the incoming goods or the conformance of performance when an invoice was due for payment. Further investigations also showed that when the payment targets were not met, there often had been a delay in releasing the invoice for the final payment. We recommended monitoring the observance of payment targets and implementing measures to reduce waiting times if needed.
The conclusion of this auditing series will appear on this blog next week. Simply come back or sign up here to be notified if you don’t want to miss it!
Leave a Comment
You must be logged in to post a comment.
