A trading business has ten first level processes. Each process can be broken down into sub-processes. Once analysed in this way, business leaders can see where control gaps exist and manage them.
2. Senior management can discover what staff are
actually doing (a real world problem).
Analysing processes. To determine whether
processes are adequate to meet control
requirements*
Identify key controls upon which the enterprise
relies**
For senior management to define required
processes to middle management and to aid
discussion between management
To communicate the processes to professionals
(especially auditors but also regulators etc.)
To define correct processes for staff (especially
definition and emphasis of controls.)
3. * The control requirements for a process are
(i) safeguard the assets of the enterprise,
(ii) produce accurate accounts and
(iii) ensure the business is carried on in an orderly fashion.
** Processes are then tweaked to ensure that adherence to key
controls are evidenced!
Mapping documents, contrary to what we often hear, are not
usually useful to train new staff. Training new staff is almost
always done on a one-to-one basis sitting in front of a computer
running the relevant applications. New staff must be made
aware of key controls.
Mapping can be done on MS Visio or Excel. Visio is much easier
to learn than it was ten years ago and is much less fiddly than
Excel. It costs about £100 per year per user.
3
4. 10 point first level process for trading
A. Reference data management
B. Setting trade objectives and environment
C. Finance management
D. Credit management
E. Transaction capture
F. Deal confirmation
G. Measure and monitor risk
H. Operations
I. Settlement
J. Accounting
4
Each of these processes are
typically split into 3-15 second
level processes. And each of these
are mapped using flow diagrams
as a third level process. It is at
the third level where key controls
are identified eg for setting up
new customers, ‘Check credit
worthiness and KYC’ would be a
key control.
5. 1. It defines in detail what has been implemented for the client. It
should tie in with the statement of work and eliminate any
ambiguity regarding deliverables and what has been delivered.
2. It will be used by the implementor to remind them what they have
built, if they are asked to do further work on the system months or
years later.
3. It leaves the client with a manual for the system and process that
has been implemented for them. The level of detail will be
appropriate for the client.
4. It will set out which processes must be regularly carried out so that
the system will work and the output be reliable.
5. It will explain what maintenance to the system needs to be done to
make it continue to work including reference data.
6. It will give details that will help someone other than the
implementor supporting the system to fix issues that may arise.
5
6. The “As-is” documentation can be written
as part of the Definition stage of the
project.
The final documentation can be written
during the Design and Build stages.
It is polished during the hand-holding
phase after Go-live phase (where there can
be quiet periods).
6
Phases of a project
Enterprise
Level 2
Need for a project
identified
1. Definition 2. Scope End3. Select 4. Design 5. Build 6. Deliver