Do you audit Controlling or Finance?

Last week I asked whether you rule Human Resources in-scope or out-of-scope for your internal audit plan. Today I want to ask the same question about the Controlling or Finance department. My answer here is a lot shorter than my answer about HR, and somewhat more tentative. In the end I still think it can be a good idea; but if you need to trim somewhere because of limited auditing capacity, this is a place you can safely trim.

The point is that ISO 9001 is not a financial standard, and – normally – quality auditors aren't trained as accountants, much less as financial auditors. So we are not likely to catch even arithmetical errors, much less any serious financial misdeeds (fraud, embezzlement, or the like). And I seriously hope that your organization's Controlling Department is already audited regularly by a reputable auditing firm, preferably while the department manager is out of the office on vacation. Anyway, those aren't the kinds of issues that we quality auditors are qualified to catch, and we shouldn't try.

What we are qualified to discuss is the effectiveness of overall business processes, and of the management system's process map. How do the different functions in the organization support each other? And the place that Controlling is most likely to enter this cycle is by supporting top management in the business planning process. 

Top management is responsible for defining the business's strategy, and then for steering and making adjustments as results become visible in the real world. Most often "results" means financial results, and Controlling is where they have to turn to request that information. So what exactly is the process by which Controlling feeds information into the business planning process? What information is collected? Why is that the right information to look at, and not something else? Also, how well does the whole planning process work? Does this information from Controlling actually tell top management what they need to know? Are there any ways the handoff could be improved, or the quality of the data itself?

If you don't have enough time in the audit plan – or enough trained auditors – you can probably afford to skip Controlling as a separate audit, and pick these topics up when you audit top management. In case there are any audit trails that lead you into Controlling you can follow them then, and otherwise it's likely that the most you will find are opportunities for future improvement. But if you can afford the audit capacity, you can learn a lot about the organization's overall management system by giving Controlling a short visit. That's why I still think it can be a good idea to rule them in-scope.