Audit Management

The Audit Management solution can be accessed using either the SAP GUI or SAP Fiori Launchpad (SAP S/4HANA On-Premise).

Audit Management has the objective to provide a solution for comprehensive auditing activities across multiple business domains and processes. The solution supports the entire audit process for all types of audits across nearly all industries. The processes supports all phases of auditing (Audit planning, Auditing, Grading, Corrective action, Analysis).

The solution provides the following capabilities:

• Comply with certain industry standards such as OSHA, ISO, API RP75 GMP, and so on
• Complete planning of audit programs and individual audits
• Audit Scheduling and Execution
• Offline processing of Audits
• Audit Valuation
• Corrective and Preventive Actions (CAPA)
• Reporting and analysis of audit data

Customers can benefit from the following:

• Simplify communication with audit partners in all phases of the process
• Integrate auditing activities for different business requirements
• Reduce the cost and complexity of auditing

Note

The Audit Management application is a component of the core SAP S/4HANA Enterprise Management license. The interactive adobe forms shown in the next slides can be delivered with a separate consulting solution, which will require an additional cost (no additional license).

Key advantages at a glance:

• As Comprehensive tool Audit management tool supporting all phases of auditing (Audit planning, Auditing, Grading, Corrective action, Analysis)
• It provides consistent, integrated and visible information by providing access using the Internet - worldwide - multilingual.
• Supports the process of attaching, printing and sending internal and external documents and reports.
• Using the Adobe Print Forms the solution supports the customizing of report templates.
• Access using SAP GUI or SAP Fiori Launchpad (on S/4HANA Systems) Audit management provides the ability of accessing the Mobile application. Download / upload through XML and Adobe Interactive Forms (using the consulting solution) is an alternative option for executing the process in the system. Through the automatic information of responsible persons the solution supports the notification of partners.
• Using the standard tools Audit management provides a mechanism for comprehensively analysis of audit data.

The following three aspects provide an overview of the audit management core process:

• Managing Audit Process
• Planning an audit program
• Performing audits
• Monitoring corrective and preventive actions
• Analyzing findings
• Managing Partners
• Maintaining and assigning business partners
• Notifying actions required
• Qualifying auditors and classifying partners
• Managing Documents
• Basic documents
• Audit evidence
• Audit reports

Overview of Data Objects in Audit Management is visually presented on the diagram above, Components and Data Objects.

The audit management cockpit is the central user interface through which the different audit components can be accessed.

The audit management process is a quite linear process which includes the usage of different audit components. It starts with the planing and scheduling of the audit. The person responsible for audit planning uses the audit planning function to create an annual audit plan (valid for more than one year) for his / her area or copies the audit plan from the previous year. Audit planning can include audit plans, subordinate audit plans, and audits. Additionally the audit planner can create a checklist for the auditors to help with the audit execution later on. The audit planner can create also a current questionnaire for the audit execution.

The audit execution (auditing online or offline) consists mainly of the assessment and valuation of the questions on the basis of the replies in the audit, the determination of the audit result and the degree of fulfillment, and the rating of the audit. The lead auditor prepares the execution of an audit.

The audit grading and evaluation provides different search possibilities for all audit components on the basis of various search criteria In the audit evaluation, you can, for example, determine the number of outstanding corrective and / or preventive actions, display all audits or question lists, and determine which audit plans exist for a certain time period.

After the evaluation has been completed, the actions (corrective and/or preventive) can be defined in the system. Corrective actions are normally the actions required to eliminate the cause of errors that were determined during the audit and to prevent the recurrence of these errors. While preventive actions are the ones necessary to eliminate the causes of possible errors before they occur. 

At the end the audit process cycle finishes with the analysis of the audited data.

The person responsible for audit planning uses the audit planning function to create an annual audit plan (valid for more than one year) for his/her area or copies the audit plan from the previous year. The audit planning can include audit plans, subordinate audit plans, and audits.

In the context of Environment, Health, Safety the responsible person (lead auditor) is the EHS Manager.

The EHS Manager calls up the audit, searches for the last audit that was performed in the audited area, reads the last audit report, and looks at the actions that are still outstanding. He / she assigns a question list to the audit (if the audit planner has not done so already). If necessary, the lead auditor can change this question list. To check the deviations recorded for the last audit he/she can formulate new questions and predefine a possible valuation for these. Then the lead auditor saves the audit question list. The audit question list can be printed out.

The system provides full flexibility in setting up an audit. The audit plan is the planning instrument for the administration of audits.

The audit plan provides an organized overview of multiple audits. A plan can contain subordinate audit plans. Audits can be linked to plans and can be grouped in a hierarchical structure. You can create annual plans for audits or for groups of audits according to the organizational relation of audit objects.

The audit plan is structured hierarchically. This means that other audit plans, as well as the audits themselves, can be assigned to an audit plan. Note that an audit is the lowest level of the hierarchy. This means that no additional audits or audit plans can be assigned to an audit.

The audit plan is the planning instrument for the administration of audits.

The detailed view of the audit provides several tabs which allows you to organize well the basic information and the contact persons, but also to monitor the status of the audit.

To be able to prepare an audit, certain information such as type and trigger of the audit, audit objects, the planned start / end date as well as the participants in the audit can be specified.

The relevant documents can be provided upfront. The required audit questions based on Excel upload can be created (as shown on the image above). The audit question can be managed based on templates and drag and drop of Audit Question List.

Once all preliminary activities have been completed, an audit plan is ready and consists of one or more hierarchically structured audit plans and one or more audits. If you choose Print Preview, the data of the current audit plan is displayed as a print preview.

Each audit plan consists of several audits.

The audit details can be organized in the details view using the tab such as Basic Data, Texts, Participants, Results, Status and Admin. Data.

During the audit, the EHS experts / auditors record replies to the questions and note any deviations and problems directly in the system online. They can also indicate individual questions as not relevant.

Online Execution of the audit consists of the following:

• Releasing audits, inviting participants, and providing documents
• Examining audit objects with regard to criteria (questioning and viewing)
• Recording findings (statements and documents)

Alternatively to the online auditing, the EHS experts / auditors can record replies to the questions and note any deviations and problems using offline adobe interactive form.

The offline auditing execution can be done by using Adobe Interactive Forms. For offline result recording the application allows to enter findings and valuations on mobile devices in order to upload XLM-files. Moreover it is possible to use Adobe Interactive Forms with support from SAP Consulting services to import and export question lists.

The software supports assessments of each area audited and the consolidation of these individual assessments to support an overall assessment or opinion. The user can decide to do this automatically, using "valuation algorithms" that can be configured to suit the organization's preference, or manually.

Note

Assessment methods for the individual audit criteria can be customized.

The system provides high flexibility for recording qualitative and quantitative results.

The application contains a series of ready-to-use valuation profiles. This allows auditors to easily valuate criteria (question-list items) as well as rate and grade audit objects.

Qualitative or quantitative assessment criteria are supported. Qualitative criteria could, for example, include the steps "good," "satisfactory," or "poor," while quantitative criteria would indicate degrees of fulfillment or deviation.

After the evaluation has been completed, the actions (corrective and/or preventive) can be defined in the system. Corrective actions are normally the actions required to eliminate the cause of errors that were determined during the audit and to prevent the recurrence of these errors. While preventive actions are the ones necessary to eliminate the causes of possible errors before they occur. 

As follow-up actions the application supports the determination of subsequent audits, corrective and preventive as well as improvement actions. Contact persons can be defined as responsible and automatically notified.

Furthermore, a monitoring of the subsequent steps and verification of the effectiveness of all actions is done.

Preliminary audit reports can be used to communicate findings, corrective actions, and overall results of audits.

The final audit report typically will be signed by both the auditor and the audited party. The use of digital signatures for status changes ensures that this step is approved by authorized persons only. The signed report can be assigned as document to the audit and distributed to key stakeholders.

The so called Audit Monitor allows an analysis and evaluation of the entire audit program or of selected groups of audits, of audit questions and results, of findings and actions as well as feedback of audit results to audit planning.

The overview list can be flexible arranged and filtered. For graphical representation the list can be exported to analytic tools or extracted to MS Excel.

The example above shows the current list of audits.

The example above shows the current list of corrective/preventive actions.

Using the analytical tools further extraction of the operational data can be done. An overview of all audits can be done. Further analysis of the audit results, state of completion, assessment of the audit objects as well as tracking of actions by responsible is possible.

The Audit Management solution supports you with functional components in three separate areas.

To support the audit planning process, the solution provides functional components to define audit schemes, to manage question lists, schedule audits, to coordinate audit teams and external stakeholder.

During the audit processing the audit manager is enabled to edit basic information, involved people, valuation criteria, corrective actions, grading of audit questions, to attach documents, to record and document findings and to use digital signatures. The solution supports an online and offline processing.

The solution enables the audit manager to create different types of outputs - form-based reports based on audit questions or corrective actions, analytics on audit findings and ad-hoc reporting as well as data extracts to Microsoft Excel or email.