But as Vasarhelyi observed the program in action, he also became very interested in what he saw as a high degree of end-user involvement in the software implementation. It’s not surprising, he says, that an internal audit department would drive the use of tools to improve auditing and controls monitoring. But at Talecris, people from organizations across the company displayed an “impressive” level of ownership over the application. “I don’t know if that was just Talecris, or whether any company might do that, but I want to study it further,” the professor says.
Tourney says the results of the business units’ close involvement in the program have been “a greater focus by management on controls, an increase in dialogue on controls, and internal audit being treated more as a business partner and less as a police force.”
Both those and other benefits of the program are either purely qualitative or their impact on the bottom line cannot be quantified, according to both Tourney and Vasarhelyi. Those benefits include, for example, elimination of 88,000 inactive vendors from the company’s vendor database, new limits on the use of procurement cards, and recording with purchase orders $12 million worth of purchases that previously had not been recorded as such.
“My difficulty in giving [bottom-line] numbers is that there were so many moving parts,” says Tourney. “There were a lot of people, not just internal audit, working on a lot of projects concurrently.” She also declines to say how much Talecris has spent on the software.
For his part, Vasarhelyi says that what can be expected to result from a continuous monitoring or auditing program is “basically a lot of quality improvement that will eventually make for better client service and give you more reliable numbers and fewer errors. But those things are very difficult to quantify, and I find it a bit flaky to try to do too much quantification.”
He notes disapprovingly that a couple of the internal audit departments Rutgers has worked with reacted to new efficiencies provided by continuous auditing or monitoring programs by getting rid of a few auditors. The staff savings are a pittance compared with substantial operational improvements, he says, and anyway, “the moment you audit deeper, more audit issues will come up.”
Tourney says Talecris has actually added internal audit staff to address the company’s growth and prepare for going public, but that the increase would have been far greater were it not for the continuous monitoring program.
One of the biggest issues for Tourney was that the company had two operating divisions with very different cultures for which different CCM processes were required. Talecris Biotherapeutics, the entity acquired from Bayer in 2005, had a long-established system of using purchase orders and was running the SAP enterprise resource planning system. The goal there was to “keep the thumb on the pulse” and tighten things up.
For Talecris Biotherapeutics, the internal audit department used its technology tool to spot, for example, payments not made according to the terms of purchase orders, the use of purchasing and T&E cards for unauthorized purposes, vendors in the database without all required fields populated, and instances of failure to receive the proper invoice credit for the return of defective supplies. Automating these processes “raised visibility,” says Tourney. “Before we started the project, a lot of these things were paper trails.”