(NOTE - "Process Creep" is not a euphemism for your SOx auditor!)

Recently, I was evaluating a process change at a company I am very familiar with.  I work with the company regularly and I assisted in their SOX testing last year.  Early in the process, I sketched out the basic changes and asked some quick process reaffirmations to the departments involved.  I received answers I wasn’t expecting.  I compared my answers to the SOX Process narratives and found they no longer matched.  I reviewed my findings with people involved. They produced a memo “streamlining” the previous process and indeed the process had changed.   This is not to say the change was bad, only unexpected.  The company understands process controls for SOX compliance and somehow, this process adjustment fell through the cracks. The process crept ahead, or evolved, since the last review date. Sound familiar?  Often, the creep is small and insignificant. Over time the creep can build up.

The problem is now the process must be reviewed after the fact. If it meets the criteria for proper checks and balances while preserving segregation of duties only the narrative will need adjustment.  However, if it is found to be deficient or counters primary controls, then we must modify or extract the process.  Everyone must stop and readjust. This is very disruptive and results in boisterous epithets of “Process Creep”.

Don’t forget, people change processes for good reasons. Some valid reasons are: there is a need for more information or less information; more authorization checks are needed (or less); improvements in technology; or the age old “I will not be caught with my pants down again!” And sometimes, someone needs a change but doesn’t have or take the time to work out the details.

Did you ever contemplate whether it was better to ask for forgiveness afterwards than permission before hand? Have you worked with someone who ”doesn’t have time for all the BS “ and ”will just get the job done”? I have found this is becoming a rampant recurring theme. It has become the litany of every self-proclaimed entrepreneurial spirit / rogue / John Wayne cowboy manager I have met or heard about. Before you run out and “try this at home”, remember: this approach only works when you are RIGHT about all of your assumptions and have the cooperation of everyone involved.  Now be honest with yourself. How often has that happened? This method will be more expedient at the start and is generally more painful in the long run. 

Let me spin a scenario using the example above. I independently develop a new hot new process. It is planned with documented processes, promoted and sold with enthusiasm.  It is approved with firm commitment.  Everyone is excited and energized. I deploy the process and later I discover the process is not what I remember it to be and there are conflicts with the new changes. Surprise Process Creep!  Now I must stop the process and untangle the knots.  The knots get tighter as time progresses.  The longer it takes to find the problem, the harder it will be to undo. After everyone gets used to the new change they will resist more when asked to go back to the original.

Process Creep can be countered in three steps: