About Business Process Audit

SOP review process gap analysis cost-saving identification operational efficiency improvement reporting. Forms handled: Process Maps, SOP Documents, Audit Findings. Legal basis: COSO framework and SA 315.

Glossary

Plain-English glossary for this service

Throughput

The rate at which a system produces output per unit time. Throughput is constrained by the bottleneck step; increasing capacity at non-bottleneck steps does not increase throughput.

DMAIC

Define-Measure-Analyse-Improve-Control — the five-phase Six Sigma project methodology used for process improvement. Each phase has specific tools and deliverables; audit reports often follow this structure.

Process Map

A visual representation of the sequence of steps, decisions and handoffs that make up a business process. The starting tool for any process audit; helps surface the As-Is state before improvement design.

Cost-Benefit Ratio

The ratio of the cost of implementing a process improvement to the quantified benefit it yields. Process audit recommendations should carry a CBR above 1:3 to merit prioritisation; below 1:1 indicates the cure costs more than the disease.

Takt Time

The maximum allowable cycle time per unit to meet customer demand, calculated as available production time divided by customer demand quantity. If cycle time exceeds takt time the process cannot meet demand.

Cycle Time vs Lead Time

Cycle time is the time taken to complete one unit of work from start to finish at a workstation. Lead time is the total elapsed time the customer experiences from request to delivery, which includes wait time between workstations. Lead time is typically much longer than cycle time.

DPMO

Defects Per Million Opportunities — the Six Sigma measure of process quality. Translates defect rate into a sigma-level scale; 3.4 DPMO equals 6-sigma capability.

Ishikawa Diagram

Also called the fishbone diagram or cause-and-effect diagram — a tool to brainstorm and organise the possible causes of a defect or issue under standard categories (Man, Machine, Material, Method, Measurement, Environment).

Value Stream Map

VSM — a lean-tool that maps both material flow and information flow across a process, identifying value-add versus non-value-add steps and the cycle time at each stage. Used to expose waste and design To-Be improvements.

Control Point

A specific step in a process where a control activity is performed to prevent, detect or correct an error or risk. Process audits map controls to risks and test design effectiveness and operating effectiveness.

Pareto Analysis

The 80/20 rule applied to process problems — typically 80% of the issues arise from 20% of the causes. Pareto chart ranks causes by frequency or impact and guides prioritisation of improvement effort.

RACI

Responsibility Assignment Matrix — a tool that clarifies who is Responsible, Accountable, Consulted and Informed for each process step or deliverable. Resolves ownership ambiguity which is the most common process-audit finding.

Statutory Basis

Operative provisions cited on this page

Every claim on this page can be traced back to a section or rule below.

COSO framework and SA 315Anchor

Statutory basis — COSO framework and SA 315

COSO framework and SA 315 is the operative provision for business process audit in this engagement. SOP review process gap analysis cost-saving identification operational efficiency improvement reporting The taxpayer should ensure the procedural conditions under this section are met before any filing or submission. Failure to comply attracts the consequences separately prescribed under the penalty and interest provisions of the same Act.

Forms Library

Forms used in this engagement

Process MapsForm Process Maps

Statutory form prescribed for Business Process Audit engagements; carries the information set required for filing or submission to the prescribed authority.

As prescribed under the relevant section / rule Prescribed authority

SOP DocumentsForm SOP Documents

Statutory form prescribed for Business Process Audit engagements; carries the information set required for filing or submission to the prescribed authority.

As prescribed under the relevant section / rule Prescribed authority

Audit FindingsForm Audit Findings

Statutory form prescribed for Business Process Audit engagements; carries the information set required for filing or submission to the prescribed authority.

As prescribed under the relevant section / rule Prescribed authority

Statutory Deadlines

Compliance deadlines that matter

Miss any of these and the next consequence kicks in automatically.

Trigger event	Days	Form	Consequence
Full business-process audit cycle covering all material processes	365 days	Audit report with management response	Coverage gap; risk-mapping becomes stale; statutory auditors may flag absence of process-audit evidence under SA 315
Post-implementation review after a process change or new system go-live	90 days	PIR report	Implementation drift; control gaps from the change remain undetected; benefits realisation cannot be confirmed
Monthly KPI dashboard publication to CFO and process owners	10 working days after month-end	KPI dashboard	Late detection of process drift; corrective action delayed by a full month; bottlenecks compound
Quarterly control testing for high-risk processes (P2P, O2C, payroll, cash)	30 days after quarter-end	Control testing report	Control breakdowns remain undetected; SOX-equivalent or ICFR sign-off cannot be supported with current evidence
Half-yearly SOP refresh and version-control update	180 days	SOP master register update	Outdated SOPs lead to inconsistent process execution; new joiners trained on stale content; audit trail breaks
Weekly Gemba walk by process owner at operational area (shop floor, theatre, warehouse, customer-facing desk)	7 days	Gemba walk log	Ground-level deviations from SOP go unobserved; process drift accelerates between formal audits
Annual COSO 17-principle internal control assessment	365 days	COSO assessment report	Internal control framework gaps remain undocumented; statutory ICFR sign-off under Section 143(3)(i) becomes unsupported
Quarterly Audit Committee process-review presentation by internal audit head	45 days after quarter-end	Audit Committee deck with findings and action tracker	Governance oversight weakened; Audit Committee charter compliance gap under Companies Act Section 177
Monthly exception report review (override usage, manual journal entries, urgency-tender bypass)	15 days after month-end	Exception report with disposition	Override patterns become normalised; preventive controls degrade into ineffective detective controls
Process audit follow-up on prior-period open findings	Within next audit cycle (typically 90 days)	Follow-up status report	Open findings age beyond acceptable thresholds; repeat findings indicate control failure and invite Audit Committee adverse remarks

Comparison

COSO 2013 vs ISO 31000:2018

Aspect	COSO 2013	ISO 31000:2018
Operative framework	COSO Internal Control Integrated Framework anchors the five components of control environment, risk assessment, control activities, information and communication, and monitoring; cited by SEBI LODR Regulation 17(8) for listed entities	ISO 31000 risk management standard sets principles, framework and process for enterprise-wide risk discipline; routinely adopted alongside ISO 9001 process audit framework for quality management
Audit nature	Examines the design and operating effectiveness of business process flows, segregation of duties and automated controls; outputs are a process map gap log and an SOP refresh plan	Examines financial and operational records under Section 138 of the Companies Act 2013 read with Rule 13 of the Companies (Accounts) Rules 2014; outputs a board-presented audit report on assurance and advisory matters
Field technique	A documentary review of the written standard operating procedure against the actual practice, used to surface drift, redundant approval steps and missing control points	A live trace of one or two transactions end-to-end through the process, mandated under SA 315 paragraph A77 to confirm that the documented process matches actual operation
Statutory and listing basis	Section 143(3)(i) of the Companies Act 2013 directs the statutory auditor to report on Internal Financial Controls over financial reporting; COSO is the universally adopted framework for that assessment in India	Not statutorily mandated under the Companies Act 2013; voluntarily adopted alongside ISO 9001:2015 clause 9.2 internal audit and clause 9.3 management review for quality-led risk discipline
Trigger for review	Triggered by a process redesign, post-implementation review of an ERP rollout, fraud red flag, or whistle-blower complaint reaching the audit committee under Section 177(9) of the Companies Act 2013	Triggered by the statutory mandate under Section 138 for prescribed classes of companies, by the audit committee charter, or by the risk-based internal audit plan approved annually
Output instrument	Produces a side-by-side SOP-versus-practice matrix, a gap log keyed to the COSO seventeen principles, and a remediation roadmap with control-owner assignment and target close dates	Produces working papers documenting the transaction trace, screenshots of system controls observed, evidence of segregation of duties, and a control-design conclusion linked to the risk register
Reporting linkage to fraud	Process gaps that indicate fraud are escalated to the statutory auditor for evaluation under Section 143(12) of the Companies Act 2013 read with Rule 13 of the Companies (Audit and Auditors) Rules 2014 for fraud reporting	Fraud surfaced during internal audit is reported to the audit committee under Section 177(4)(iv) and, where it crosses the rupees one crore threshold, separately to the Central Government in Form ADT-4
Independence and oversight	Principle 1 demands board oversight of internal control; Section 149(8) Schedule IV places independent directors at the centre of monitoring through the audit committee	Calls for top-management commitment under clause 5.2 and integration with governance structures; certification is voluntary and is conferred by accredited certification bodies
Reporting on Internal Financial Controls	Clause (xi) and clause (xx) of paragraph 3 of CARO 2020 require comment on fraud reporting and the adequacy and operating effectiveness of internal financial controls with reference to financial statements	Requires the auditor's report to state whether the company has adequate internal financial controls with reference to financial statements and the operating effectiveness of such controls
Regulator-led enquiry route	Serious Fraud Investigation Office constituted under Section 211 of the Companies Act 2013 investigates process-bypass and complex inter-company frauds on Central Government referral	National Company Law Tribunal entertains oppression and mismanagement petitions under Sections 241 and 242 of the Companies Act 2013 where process-bypass amounts to mismanagement of company affairs
Government enquiry power	Registrar of Companies may call for information and conduct inspection under Section 206 of the Companies Act 2013 on documents and processes	Section 458 of the Companies Act 2013 allows the Central Government to delegate any of its powers under the Act to authorities including process-bypass enquiry triggers
External standard-setter scrutiny	National Financial Reporting Authority constituted under Section 132 of the Companies Act 2013 has passed orders penalising auditors for failure to identify process-gap-driven mis-statements	Disciplinary directorate under the Chartered Accountants Act 1949 proceeds against members for professional misconduct including failure to apply SA 315 walkthrough and SA 330 control-testing standards