Customer relationship management: risks and controls; Built to better serve customers and increase sales, CRM database systems need specific controls to mitigate the associated risks

Internal Auditor, Dec, 2004 by George R. Aldhizer, III, James D. Cashell

In addition to security controls, auditors should conduct periodic penetration tests, such as war dialing, port scanning, sniffing, and password cracking, to help ensure that existing network and internal firewall configurations, among other things, are effective deterrents to external and internal attacks.

Customer Call Centers

Another critical CRM-related component is the customer call center. Because call centers provide a direct link between customers and the organization, they have a substantial influence on CRM success. A call center representative may be the only human that a customer associates with an organization, especially within the credit card, telephone, utility, cable/satellite television, and Internet service provider (ISP) industries. In fact, according to Ernst & Young Partner Alan Siegfried and Senior Manager Robert Schmollinger, who specialize in CRM-DMSs, 50 percent to 70 percent of all customer contacts originate via a call center representative. Customers with inferior call center experiences may take their business elsewhere, negatively impacting future organizational revenues and earnings.

AUDITING A CALL CENTER

The first step in auditing a call center is to obtain a clear understanding of its objectives. Because of potential conflicts of interest and misunderstandings, it is important to interview all of the key players, such as top management, sales and marketing representatives, and call center agents and supervisors. Reaching a consensus as to the role of the call center is crucial to CRM's success. For example, is the primary role of the call center to increase customer retention rates, to increase revenue growth, or to minimize operational expenses?

Some of the key components impacting call center effectiveness and efficiency are:

* Budgeting and key performance indicators (KPIs).

* Call center performance and monitoring policies.

* Recruitment and training policies.

* Compensation policies.

* Electronic linkage procedures if the organization has multiple centers.

Careful consideration of these aspects in the audit should help ensure that call center risks are minimal.

BUDGETING AND KEY PERFORMANCE INDICATORS

The call center budget and KPIs should align with call center objectives and reflect an appropriate balance between call center effectiveness versus efficiency. For example, if call center objectives include increasing customer retention rates, the appropriate KPIs could be the percentage of calls resulting in customer complaints, the percentage of abandoned calls, and/or the percentage of calls closed or resolved via the first customer call. Based on call center KPI survey results reported by Ernst & Young in 2003, only 5 percent of calls resulted in customer complaints, an average of 5.4 percent of calls were abandoned, and an average of 78 percent of calls were closed or resolved via the first customer call.

If the call center objectives include efficiency measures such as minimizing operational expenses, the appropriate KPIs could be the average speed to answer a customer call, the average talk time per call, or the average cost per inbound call. Ernst & Young's 2003 survey suggested that the KPI benchmarks for enhancing operational efficiency include an average of 36 seconds to answer a customer call, an average talk time of 4.3 minutes per call, and an average cost of $7.70 per inbound call.