Debi,

I think you might want to be careful in your use of the term "audit". That
has a lot of different meanings to people and you may have contract
language that outlines what you can and can't do with regard to observing
the vendor's operations (we've all seen some really ugly language that
folks have signed up for). In many cases, getting the sort of statistical
data that you're asking for will be refused because it is out of scope of
the contract.

At best, you will likely be able to do an escorted (and scheduled) facility
walkthrough where you can observe operations, security, cleanliness, etc.
That's helpful. It's also helpful to drive by the vendor's facilities from
time to time, and observe what's going on. Be careful about trespassing.
Doing a "red team" exercise to try and get into a facility without
permission could get you arrested. For that matter, sitting in your vehicle
taking pictures could get you a conversation with law enforcement. In some
respects, those would be the correct outcomes because it means people are
paying attention, but might be difficult to avoid some sort of challenge,
customer or not.

A true audit would have two components: a Test of Design, which is a
walkthrough of the procedures associated with a business process, including
discussion and documentation of process controls. Most vendors will do this
on a limited basis -- although likely moreso to impress you with the
technology being used to track boxes. The second component is Test of
Effectiveness, which is where you gather samples of evidence to show that
the Design is working effectively. That can be more difficult if you don't
have that requirement in your SoW. The real difficulty is in imposing any
meaningful remediation of deficiencies found. So let's say that the
facility has a procedure written down that inbound new boxes are scanned in
to a facility within two hours of arrival. You feel that is reasonable in
the review of the process design. When you want to test the effectiveness,
you find out that the facility has ten pallets of boxes that were delivered
a week ago and have not yet been scanned. Now what? That's a process
deficiency. Does your contract allow you to remediate the deficiency,
collect damages, or simply register a complaint? Odds are, the answer will
be that you can complain and they might try to do better next time. That
pretty much renders the audit process moot. And few vendors will sign up
for a contract that allows extensive customer auditing with meaningful
penalties. Breach of contract is similarly difficult to enforce. But try to
work some of those terms into your contract or Statement of Work.

So it is important to decide what you feel is the goal of the exercise and
then review the limitations of the contract with the vendor. That may
temper your enthusiasm. On the other hand, a vendor that really wants to
partner with you and welcomes the opportunity to improve its processes, may
handle an audit really well. But determine if you want a general comfort
level with the vendor or if you truly want to measure performance and
effectiveness of their internal controls.

One of the easy wins when reviewing an offsite vendor is a review of the
invoices for services against your contracted pricing. You may find some
opportunities for cost recovery simply by validating how you're being
billed. If you have good controls over what goes in and out of your
company, a review of that billing can also be enlightening.

Patrick Cunningham, FAI

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]