Assessing the people process: walking through an organization's people value chain can give internal auditors a fresh perspective on the human resources department

Internal Auditor, Feb, 2005 by Donald Espersen

IN A 2003 IIA GLOBAL AUDITing Information Network flash survey that asked auditors how important human resources (HR) audit projects were in their overall audit plan, 36 percent of the participants said they were a low priority, 43 percent said they were moderately important, and 21 percent said they were very important. Although HR is not a core business process (i.e., a value chain activity) in most organizations, it is one of the key support processes, and its risk and audit priority levels should fall somewhere between moderate and high.

In my discussions with internal audit practitioners regarding HR risk assessments, one challenge I often hear about is the "show me the money" factor, because it is difficult to quantify the risk impact. Other challenges are the newness of the assessment, as many internal audit groups haven't done a full review of HR, and client attitudes, with many clients believing HR is too complex for internal auditors to understand.

One way for internal auditors to get a fresh perspective on HR is to understand their organization's "people process." This perspective can help auditors break out of a "risk silo" mentality that can be created by focusing on functions or departments in isolation.

A FRESH PERSPECTIVE

Many HR functions say their area of primary responsibility is the organization's people process, or its "people value chain." One of the business objectives of this process is to maximize workforce performance. The people process has sponsors (senior management and the compensation committee) and clients (managers and employees).

The process starts with a strategic assessment (see "The People Process," page 85). This is where HR develops staffing plans to support the organization's objectives and strategies. The process continues as hiring, training/development, and performance management activities are carried out. Finally, ongoing workforce relations and environment activities (e.g., recognition programs and employee surveys) take place. At the center of the people process are the executives and staff that comprise the HR function.

IDENTIFYING RISKS

The IIA's "Auditing Your Human Resource Function" seminar includes a risk assessment exercise where participants identify their top HR risks. A few of the most interesting and most frequently mentioned people process risks arise in the areas of objectives, employee skills, HR competency, processes, and outsourced activities.

OBJECTIVES Unaligned objectives is a risk event imbedded in the first people process activity--organization design and staffing plans. When HR does not have the appropriate level of involvement in the strategic planning process and its objectives are not aligned with those of the organization, the result can be a ticking time bomb. This disconnect can prevent management from achieving its strategic objectives. It can also result in huge compliance issues (e.g., organization downsizing, staff reductions, and unintended employment law litigation). Some organizations have managed this risk via enterprise risk management activities. In others, where HR is a key player on the management team, this is a nonevent.

EMPLOYEE SKILLS Human capital skill gaps is another risk is embedded in organization design and staffing plans. Risks arise, for example, when organizations have heavy concentrations of experienced employees in "skill positions" who will be retiring soon. A second skill gap risk is linked to changing operating environments and new strategies. These changes often require new skills that can take time to develop or acquire. Best practice HR functions manage these risks via employee database information and competency forecasting techniques.

HR COMPETENCY HR staff are at the center of the people process. HR and internal audit groups have a lot in common. Both have professional associations and certifications and play key roles in their organization's governance process. It is also possible for both groups to have skill gaps. Some of these gaps can be remedied via training or other resources--in other cases, a change of personnel is required.

HR competency gaps are a real risk in many organizations. The internal audit issue is how to identify and communicate these gaps to management. To comply with The IIA's International Standards for the Professional Practice of Internal Auditing, auditors have internal quality assessment programs that can include client surveys and peer group benchmarking on staff profiles (e.g., size, experience, and certifications). HR should have a similar quality program.

[GRAPHIC OMITTED]

PROCESSES The people process, like all other processes, is subject to communication breakdowns, bottlenecks, faulty handoffs, and inefficiencies. What makes it somewhat unique is that inconsistent compliance (e.g., hiring or promotion policies) and too much (e.g., supervisor comments in "unofficial" employee files) or too little documentation (e.g., involuntary terminations) can result in litigation and reputation damage. Of course, the likelihood and magnitude of these risks depends on the organization. Best practice HR functions use technology (e.g., employee kiosks to update information, more reliance on automated controls), training, and monitoring to manage process risk.