1 FVO meeting Dublin March 9/ Beyond compliance auditing! drs. Rob. S. de Heus EMIA RO; Head of the auditdepartment (CAE) Food and Consumer Product Safety Authority (VWA)

2 The problem defined If compliance to Reg 882 / 2004 is required but repeatedly offended, another approach to auditing is preferred. (wondering versus verifying)

3 Compliance / conformity is about… ‘to do or not to do’, but that’s no longer the question when employees frequently do not comply

4 3 starting points for (internal) auditing  Do we have a problem? (Problem detection);  What is the cause of the problem (diagnostic);  How do we assess the proposed solution? (design testing).

5 Verificating system Operating system output input Steering signal Measuring outcome Double loop learning (diagnostic auditing) Assessing the assumptions / ideas and standards Single loop (Compliance auditing) consistency between outcome and standards steering system

6 Internal (management) control T o find solutions for these issues, we have to pay more attention to management control, …but, what is management control?

7 Management Control Anthony: “The process by which managers influence other members of the organisation to implement the organisation’s strategy.” John Kotter: “The central issue is never strategy, structure, culture or systems. The core of the matter is always about changing the behaviour of people.”

8 Management control issues (Kenneth A. Merchant, 1998)  Lack of direction (Do they understand what we expect of them …)  Personal limitations (Are they capable of doing what is expected of them...  Lack of motivation (Will they work consistently hard and try to do what is expected of them...)

9 Thesis If all the employees know what should be done and are capable of acting so and are willing to do so, then complying to any rule or regulation is no longer an issue!

10 In other words: How does management take care of employees ….  Knowing what to do;  Make them capable for their duties;  Preparing willingness to do what is asked for.

11 Example 1) All employees have to fill in their time sheets within the first week of the new month, but they don’t do this! knowledgeabilityintentions Employees are not informed about this instruction The registration systems are user unfriendly; It’s difficult to find the list with the most actual time registration codes Employees feel no importance at registrating; There is no supervision/control of completeness, timeliness and correctness Employees are automatically informed (by the computersystem) when they have to fill in their time sheet. A hyperlink in the programme gives direct acces to the time codes table. Solutions

12 Example 2) Deficiencies are not documented knowledgeabilityintentions Employees do not understand the reasons and the importance of documenting There is no system for recording defects; There’s not enough time; Data communication is too slow Employees are not interested in documenting; There is no supervision on completeness, timeliness and accuracy; It’s more comfortable to cooperate with the company then it is to confront them Solutions: Allocate documentation-time in the planning; Discuss importance with them; so they know something is done with the documents

13 Example 3) An incorrect model health certificate is been used knowledgeabilityintentions Empl. are not informed well enough about the correct model health certificate and the correct attestation. There’s not enough appreciaton for Permanent Education There are no instructions and example certificates available There is no supervision of using the correct model health certificate; Dealing with transporters importing goods is always a matter of handling with pressure; it’s easier to cooperate with them, than to confront them Solutions: Programmed solution; the system always gives the most actual certificate

14 Implications; 1) focus on management issues!... Audit should direct the attention to the management actions to prevent  Lack of direction  Personal limitations  Lack of motivation

15 Implications 2) …and take a look at…! Examples of control actions by management Lack of directionPersonal limitationsLack of motivation Clearness in instructions Setting smart goals Updating the rules and regulations Codes of conduct Mandates Providing means and materials Accessibility of information (systems) Consistency in assignments Behaviorial constraints Separation of duties Direct supervision Peer reviews Acceptable workload Paying attention to – Adequacy in communication Creating shared goals /beliefs Discussing ethics and morality Creating an atmosphere of trust Giving compliments Empowerment

16 Implications 3) add value! By …  Paying attention more to causes than to problems / non-compliance only, and  Directing attention also to (sustainable) solutions …auditing will deliver more added value to management

17 Implications 4) Challenges! It’s very challenging for auditors to give an opinion on the causes of non compliance, because..  There is no standard or checklist  Auditors will be confronted with different perceptions  Auditors will wonder if they are in the right position to assess…  Auditors will wonder if they can conclude on the basis of subjectivity and opinions when there is lack of objectivity and/or facts

18 Implications 5) It’s possible! But; we can do it !! There is already much to conclude from:  Missing actions (e.g. no supervision, no communication)  Inconsistencies (e.g. conflicting instructions)  Redundancy / overkill (e.g. unnecessary checks and balances while management wants to trust on employees expertise)  People’s attitude / motivation ( e.g. the way they speak about their work)

19 Conclusions It’s not very effective to repeatedly conclude that our organisation is behaving in a non compliant way. We can deal with this problem by changing the focus of our internal audits to a more diagnostic approach. By doing this, we can define the underlying causes of non compliance and suggest ways to solve these issues. In this way we really increase added value to management!

20 ? Do you have any questions or remarks?