Auditing of explorative processes

Abstract

Process management is a central part of quality management concepts like Total Quality Management, methods like Six Sigma and Lean but also of management systems standards such as ISO 9001, where it is represented by different requirements on process design, process control and process improvement. Research has been conducted on process management and the understanding of exploitation and exploration, but also the sometimes negative effects from process management practices on exploration in organisations when operating in competitive environments. The purpose of this paper is to study if internal auditors adapt to explorative processes when auditing ISO 9001 process management requirements. This paper is based on a qualitative case study in a global company in the consumer electronics industry. The study points towards that internal auditors apply ISO 9001 MSS requirements for process control across the studied organisations and processes even though the audited organisations and processes were considered to be explorative and the environment competitive. Not adapting requirements for process management, to an explorative process in a competitive environment, can stunt an organisation’s capability to be innovative, thereby negatively affecting its competitiveness.

Keywords:

• ISO
• quality management
• process management
• audit
• exploitation
• exploration

1. Introduction

Process management (PM), defined as the three practices of process design, process control, and process improvement (Hackman & Wageman, 1995; Juran & Godfrey, 1999) – has grown in importance over recent decades and is now a central part in quality management (QM) concepts like Total Quality Management (TQM) (Hackman & Wageman, 1995), and in methods like Six Sigma (Raisinghani, Ette, Pierce, Cannon, & Daripaly, 2005) and Lean (Womack & Jones, 1996). These concepts and methods have been implemented throughout many organisations as a means to increase operational efficiency, but also to improve the quality of already existing products and services in order to increase customer satisfaction (Andersson, Eriksson, & Torstensson, 2006; Poksinska, Pettersen, Elg, Eklund & Witell, 2010).

In addition to the above concepts and methods, the ISO 9001 management system standard (MSS), which is now implemented by more than one million organisations worldwide (International Organization for Standardization [ISO] survey, 2015a), drives PM practices through various requirements, which organisations are obliged to fulfil if they have chosen to have a certified management system (MS). Examples are PM requirements for determining processes, applying methods for monitoring and measuring processes, and for improving processes (International Organization for Standardization [ISO] 9001:2008). Moreover, PM is one of the seven quality management principles (International Organization for Standardization [ISO].org, 2015c) upon which the ISO 9001 MSS is built, and has been expanded in the latest version of the ISO 9001 MSS to also include additional requirements in areas such as determining input and output from processes, establishing criteria for control of processes and applying and evaluating performance indicators (International Organization for Standardization [ISO] 9001:2015b).

However, becoming and staying competitive over time is not just about the ability to increase efficiency and reduce variation in various processes; that is, being exploitative. It is also about searching, being innovative and embracing variation; that is, being explorative (He & Wong, 2004; Gupta, Smith, & Shalley, 2006; O’Reilly & Tushman, 2008). Furthermore, earlier research argues that PM practices that support exploitation and survival in the short run can even stunt exploration and the ability to be innovative for long-term survival (Benner & Tushman, 2003). Moreover, it has also been argued that an ISO 9001 certification may reduce an organisation’s ability to innovate (Terziovski & Guerrero, 2014). To mitigate this, it has been proposed that organisations need a dual focus, both on practices like PM that help decrease costs, but also on practices like ambidexterity which enable innovation and flexibility (O’Reilly & Tushman, 2008; Raisch, Birkinshaw, Probst, & Tushman, 2009; Matthews, Tan, & Marzec, 2015). Correctly balanced, PM practices can contribute to both exploitation and exploration at the same time (Bot, 2012; Antony, Setijono, & Dahlgaard, 2016; vom Brocke, Zelt, & Schmiedel, 2016), so it is important to apply all three PM practices – design, control and improvement – in a careful manner. These three practices can even be customised to fit the level of competitive environment in which the organisations operate in order to enable both efficiency and innovation (Sanders Jones & Linderman, 2014). In case of a certification to any MSS, the selection of processes being certified should be done with caution (Terziovski & Guerrero, 2014).

In an organisation holding a certified MS, internal audits are performed in order to understand whether the organisation’s MS conforms to the MSS requirements such as PM requirements (ISO 9001:2008; ISO 9001:2015b). However, in order for internal auditors to add value beyond verifying conformance, it is vital to ensure relevant knowledge and understanding of the organisation’s challenges in the area being audited (Lenning & Gremyr, 2017). As previous research has shown that PM practices can have a negative effect on explorative processes, it is of interest whether internal auditors apply MSS requirements for PM with a one-size-fits-all approach or with an adaptive approach, thus supporting the need for a dual focus on managing both exploitative and explorative processes such as ambidexterity. However, there is a lack of research on whether or not internal auditors auditing PM requirements in ISO 9001 adapt to the process being audited. Thus, the purpose of this paper is to study if internal auditors adapt to explorative processes when auditing ISO 9001 process management requirements. This purpose will be addressed by studying internal auditors’ practices for internal auditing and the results from audits in a large company in the consumer electronics sector. While previous research has focused on understanding exploitation and exploration (March, 1991; O’Reilly & Tushman, 2004), PM practices as such (Benner & Tushman, 2003), but also the effects of PM practice on exploitation and exploration (Benner & Tushman, 2003), the results of the present study contribute in three ways. Firstly, earlier research on the effects of PM practices on exploration is now linked with internal auditing of PM requirements in the ISO MSS 9001. Secondly, a focus on the internal auditor as being a key person in operationalising PM requirements has been introduced and thirdly, rather than focusing the effects of PM on exploitation and exploration this paper focus on adaptation of PM practices to better support explorative process in competitive environments.

2. Theoretical framework

This theoretical framework will be divided into two parts, starting with an account of the concepts of exploitation and exploration followed by an elaboration on the impact of process management on exploitation and exploration.

2.1. Ambidexterity, exploitation and exploration

Even if it is complicated, an organisation should not focus solely on either exploitation or on exploration; it is important to understand how to balance the two (March, 1991; Sutcliffe, Sitkin, & Browning, 2000; Smith & Tushman, 2005; Palm & Lilja, 2017) – so-called ambidexterity (Duncan, 1976). In this paper exploitation is referred to as choice, refinement, efficiency, selection and execution, and exploration is referred to as search, risk taking, variation, flexibility (March, 1991; O’Reilly & Tushman, 2004). It has been argued that ambidexterity is increasingly necessary in dynamic environments where companies’ existing advantages are continuously at risk and new opportunities must frequently be found (Junni, Sarala, Taras, & Tarba, 2013). Organisations that have become successful at balancing both exploitation and exploration have managed to both use and refine their present knowledge at the same time as they create new knowledge (Turner, Swart, & Maylor, 2013). These organisations have been shown to be more successful in launching breakthrough products and services than more traditional organisations, meaning either exploitative or explorative (Tushman, 1997; He & Wong, 2004; O’Reilly & Tushman, 2004; Smith & Tushman, 2005). Different key success factors that can help create ambidextrous organisations have been put forward by a number of researchers. Firstly, different organisational setups are proposed in order to manage these sometimes conflicting requirements of an exploitative versus an explorative process. Duncan (1976) proposed that organisations need to shift their organisational set up over time in order to align their organisation to strategic requirements for innovation or efficiency, so called sequential ambidexterity. A second type of ambidexterity is structural ambidexterity which is built upon a split of an organisation into units considered to be exploitative or explorative, where units are then held together by a common vision and a strong senior team (Tushman & O’Reilly, 1996, 2002). A third type is contextual ambidexterity which is the ability to enable and encourage individuals to decide how they divide their time between possibly contradictory demands for alignment to present activities (exploitation) or adapt to new demands (exploration) (Gibson & Birkinshaw, 2004). Other factors that have been shown to be important are leadership and their ability to fit strategy, structure, culture and process (Birkinshaw, Zimmerman, & Raisch, 2016), the ability to combine cost cutting with entrepreneurship and the formation and communication of a clear and compelling vision in which both exploitative and explorative teams can identify themselves (O’Reilly & Tushman, 2004). Moreover, the importance of being ambidextrous has been identified to differ between industries, where ambidexterity is reported to be important in manufacturing but even more important in the high technology and service industry (Junni et al., 2013). Hence, organisations should balance exploitation and exploration according to their own needs (March, 1991; Gupta et al., 2006).

Exploitation and exploration represent different attributes of an organisation, for example, different strategic focus, capabilities and cultures (see Table 1). Exploitation is described in terms of choice, refinement, efficiency, selection, implementation and execution, and is an enhancement and addition of existing competence and technologies. Results from exploitative activities are often foreseeable, adjacent, and usually positive (March, 1991; O’Reilly & Tushman, 2004). Exploration, on the other hand, is described as search, risk taking, variation, play, flexibility, and innovation and can be characterised as a form of experimentation. Hence, the result is more unreliable, distant, and sometimes not so positive (March, 1991; O’Reilly & Tushman, 2004).

Table 1. Synthesis of exploitative and explorative attributes based on March (1991) and O’Reilly and Tushman (2004).

	Exploitative attributes	Explorative attributes
Strategic focus	Cost, profit	Innovation, growth
Critical tasks	Operations, efficiency, incremental innovation	Adaptability, experimentation, new products/services, breakthrough innovations
Capabilities	Operational, refinement, extension	Search, entrepreneurial
Organisation	Formal, mechanistic	Adaptive, loose
Controls, rewards	Margins, productivity, positive and predictable return	Milestones, growth, often negative and unpredictable return
Culture	Efficiency, low risk, quality, customers	Risk taking, speed, flexibility, experimentation
Leadership role	Authoritative, top down	Visionary, involved

2.2. Process management and the impact on exploitation and exploration

Already in Deming’s (1988) improvement framework, organisations were seen as a system of interlinked processes and the improvement thereof was seen as a prerequisite for improving efficiency and performance (Dean & Bowen, 1994), which drew attention to PM. There has also been increasing pressure to implement QM concepts and methods like TQM, Six Sigma and Lean, and also to be certified according to any of the ISO MSS (Benner & Tushman, 2003). In these concepts and methods PM is a central practice and the ISO 9001:2015 MSS contains several explicit requirements related to PM. The introduction to the ISO 9001 MSS states that the standard promotes a process approach. Furthermore it is detailed that an ‘organisation shall establish, implement, maintain and continually improve a Quality MS, including the processes needed … ’ (ISO 9001:2015b, p. 2). This focus on establishment, implementation and improvement aligns to the commonly used clustering of PM practices; design, control and improvement (Hackman & Wageman, 1995; Juran & Godfrey, 1999).

The impact of PM on exploitative and explorative abilities has been studied and it has been argued that PM practices drive a culture of local search, i.e. exploitation. This, in turn, results in a decrease and a crowding-out effect of the more explorative forms of innovation, which, in a turbulent environment could negatively impact a firm’s chances of survival (Benner & Tushman, 2002). However, the effects of PM practices also differ depending on the level of competition in the industry in which the organisation operates. In organisations operating in fierce competition and with a high rate of product change, both exploitative and explorative activities are needed, while organisations operating in low competition and with less need for product change benefit most from exploitative activities. Organisations operating under mixed conditions – that is, a changing level of competition and need for product change – benefit most from exploratory activities (Sanders Jones & Linderman, 2014). Therefore, Sanders Jones and Linderman (2014) argue that there is a need to distinguish between the different PM practices (design, control, and improvement) based upon the competitive environment in which the organisations operate. Process design is found to be positive and independent of the competitive intensity, while process control could have a have a negative effect on innovation performance in intense competitive environments. Lastly, process improvement in intense competitive environments could also weaken an organisation, while these processes might soon be outdated anyway. Instead, these organisations should spend time developing new processes that will help them to stay competitive (Sanders Jones & Linderman, 2014).

Hence, it is has been proposed that managers should carefully adopt PM practices regardless of the increasing pressure for PM practices in initiatives like ISO 9001 and other QM concepts (Benner & Tushman, 2003; Benner, 2009; Müller, Ulrich, & Nielsen, 2014; Terziovski & Guerrero, 2014). When more drastic transformations are needed, MSS like ISO 9001 may even slow down the response to the change (Benner, 2009) and stifle product innovation (Terziovski & Guerrero, 2014). Moreover, standards like ISO 9001 are seen to support a culture focused on stability and control, rather than an innovative organisation searching for new products. Therefore, it is also important that PM practices are differentiated based upon the level of competition in the industry (Sanders Jones & Linderman, 2014). Thus, from an initial argument that PM practices should be kept isolated from exploratory activities (Benner & Tushman, 2003), it has later been suggested that PM practices should be customised in order to enhance efficiency and/or innovation and not applied with a one-size-fits-all approach (Sanders Jones & Linderman, 2014; Zhang, Linderman, & Schroeder, 2014; Ng, Rungtusanatham, Zhao, & Lee, 2015).

3. Method

The purpose of this paper is to study if internal auditors adapt to explorative processes when auditing ISO 9001 process management requirements. Because this is a dynamic and complex phenomenon to study, qualitative methodological approaches are suitable (Flick, 2014). Moreover, this phenomenon requires an understanding of connections between the setting and the phenomenon, a type of research suited to the case study methodology (Meredith, 1998; Dubois & Gadde, 2002; Voss, Tsikriktsis, & Frölich, 2002). The research approach used in this paper is the so-called systematic combining (Dubois & Gadde, 2002). This abductive approach involves movement between theory and empirical data, and conclusions are drawn when enough data has been collected from the case.

3.1. Case selection

The company studied in this paper, referred to here as Electronics, is a large company in the consumer electronics sector. Electronics operates in a fiercely competitive environment where product life cycles have become shorter and shorter and the need for quick adaption to new and changing requirements has increased over the years. Since 2014, new explorative functions have been added to the organisation and the setup is considered to represent structural ambidexterity. The company is certified for ISO 9001, ISO 14001, and other industry-specific standards. However, this study focuses on the ISO 9001 certificate, which covers areas from research and innovation, product planning and development, marketing, sales, sourcing and supply chain management to after-market. As a part of holding the ISO 9001 certificate, there is a yearly audit programme including internal (first-party) and external (third-party) audits. This programme should take into consideration the importance of different processes, changes currently affecting the organisation, and the results of previous audits, both internal and external (ISO 9001:2015b). The individual audit performed within Electronics follows a standardised process based upon ISO 19011:2011 (International Organization for Standardization [ISO] 19011:2011) (see Figure 1). The focus of data collection is indicated in Figure 1 and further elaborated upon in Section 3.2.

Figure 1. Six-step audit process and indication of the focus of the data collection.

3.2. Data collection

This study has used multiple data sources, such as organisational documentation of different types, interviews with auditors and auditors’ list of questions. In order to strengthen the reliability of the findings triangulation of these sources was used (Eisenhardt, 1989). Collection of data was divided into three steps: (1) study of auditors’ list of questions prepared for two audits, (2) key informant interviews, and (3) studies of audit reports from internal audits performed between 1 January 2009 up until and including 31 December 2016.

3.2.1. Data collection from auditors lists of questions

In the first step, two lists of questions from two audits, predefined by the auditors, were studied. The purpose of studying these questions was to find out how the auditors considered the different PM-related requirements and, given that they were going to audit processes considered to be explorative, whether they adapted to that circumstance. The list of questions was prepared by the auditors in step 2 of the audit process (see Figure 1) and represents the different MSS requirements that were planned to be covered in the audits. These questions were asked during the audit interviews in order to find evidence for whether the auditee or organisation conform to the requirements in the MSS. The list of questions used in this study came from two of the chosen audits (D and E; see Table 2). Due to lack of accessibility of data from the other audits, only these two lists of questions were studied. As evidences, questions specifically related to the PM practice ‘process control’ was looked for, but also the balance between questions focusing on process design, control and improvement.

Table 2. Explorative processes included in the case study and examples of corresponding explorative attributes.

Audit report	Process(es) and main purpose of the process	Units involved in the process characterised as explorative	Examples of explorative attributes according to Table 1
A	Product design process Designing products with attractive graphics, industrial design and colours	Design centre	Visionary, Loose New products Risk taking
B	Portfolio planning process Product planning process Design of the long-term portfolio and product plan	Product planning	New products Risk taking Growth
C	Provide Technology Strategy Explore & Scout Technologies New technology introduction Researching technology and new technology introduction	Technology research	Experimentation Unpredictable return Breakthrough innovation Risk taking
D	Incubation process Exploring new technologies 2–5 years out, drive new products and business propositions	Business incubation	Experimentation New products/services Unpredictable return Entrepreneurial Risk taking
E	Service and content business development process New business creation and support	Business development	New products/services Adaptive, Growth Risk taking
F	Software development process Ensuring delivery of the correct product with correct quality. Accelerate innovation of new differentiating areas	Software development	Experimentation New products/services Speed/flexibility

3.2.2. Data collection from informant interviews

In the second step of the data collection, five semi-structured interviews were conducted with lead auditors and auditors. The purpose of these interviews was to collect a more in-depth understanding of whether these auditors adapted to the explorative process they audited. All interviews were conducted on site by the author and lasted anywhere from 47 to 77 minutes and were recorded and partly transcribed. All interviews covered the six steps in the audit process (see Figure 1). Hard copies of audit reports from internal audits, where the auditor were part of the audit team, were used together with a copy of the six-step audit process, described in Figure 1. The interviews focused on reflections on the audits and what adaptations, if any, the audit team had made to the explorative process.

3.2.3. Data collection from audit reports

In the third step, using purposive sampling (Flick, 2014), a selection of relevant audit reports from audited processes were chosen by the author using the attributes of exploitation and exploration described by March (1991) and O’Reilly and Tushman (2004) (see Table 1). The focus was on selecting audits of typically explorative processes; Table 2 summarises the selected processes, their main purpose, corresponding organisations, and typical explorative attributes.

3.3. Data analysis

Data analysis was performed using the so-called Pattern Matching method (Mills, Durepos, & Wiebe, 2009). In order to analyse the collected data from audit reports and explore whether auditors adapted their way of auditing requirements for process management practices to the processes characterised as explorative, a pattern matching tools was created (see Section 3.3.1; the usage of the tool is described in Section 3.3.2). Moreover, the author has several years of knowledge, insights, and experience in internal auditing as a trained and certified lead auditor for both ISO 9001 and 14001 MSS, which helped in the data analysis in areas such as interpretation of audit findings and classification of findings using the pattern matching tool.

3.3.1. Pattern matching tool

The PM requirements in the ISO 9001:2008 MSS were mapped towards the key practices of PM (design, control, and improve), described in the theoretical framework. The mapping was then validated by two trained lead auditors, after which some corrections were made. This tool, named the data analysis tool, was utilised to categorise audit findings from the selected audits towards the three PM practices (see Table 3).

Table 3. Data analysis tool: ISO 9001:2008 process management requirements and corresponding PM practice.

A. ISO 9001:2008 requirement	B. Requirement related to PM – description	C. PM practice
4.1a	‘Determine the processes needed for the quality management system’	Design
4.1b	‘Determine the sequence and interaction of these processes’	Design
4.1c	‘Determine criteria and methods needed to ensure that both the operation and control of these processes are effective’	Control
4.1d	‘Ensure the availability of resources and information necessary to support the operation and monitoring of these processes’	Design
4.1e	‘Monitor, measure where applicable, and analyse these processes’	Control
4.1f	‘Implement actions necessary to achieve planned results and continual improvement of these processes’	Improvement
5.5.2	‘Ensuring that processes needed for the quality management system are established, implemented and maintained’	Design
5.6.2c	‘The input to management review shall include information on … process performance’	Control
5.6.3	‘The output from the management review shall include any decisions and actions related to  … improvement of  … and its processes’	Improvement
7.5.2	‘The organisation shall validate any processes for production and service provision where the resulting output cannot be verified by subsequent monitoring or measurement’	Control
8.2.2	‘An audit program shall be planned, taking into consideration the status and importance of the processes and areas to be audited’	Control
8.2.3	‘The organisation shall apply suitable methods for monitoring and, where applicable, measurement of the quality management system processes. These methods shall demonstrate the ability of the processes to achieve planned results. When planned results are not achieved, correction and corrective action shall be taken, as appropriate’	Control
8.4	‘The organisation shall determine, collect and analyse appropriate data to demonstrate the suitability and effectiveness of the quality management system and to evaluate where continual improvement of the effectiveness of the quality management system can be made  … The analysis of data shall provide information relating to the characteristics and trends of processes’	Control

3.3.2. Pattern matching

For the case of Electronics, operating in a fiercely competitive environment, it is concluded from the theoretical framework that the different PM practices have different effects on explorative processes (Benner & Tushman, 2002; Sanders Jones & Linderman, 2014). Therefore, the data analysis tool was used in the following way as an example. If auditors classified a finding, in an audit of any of the explorative processes described in Table 2, as being a non-conformity towards the ISO 9001:2008 MSS requirement 4.1e, stating that ‘The organisation shall monitor, measure where applicable and analyse these processes’ (ISO 9001:2008, p. 2) (see Table 3), it could be argued that the adaption from the audit team is low or non-existent. This is due to the fact that the ISO 9001:2008 4.1e was mapped as a PM practice that drives process control (see Table 3). Requiring process control in an explorative process, in an environment of fierce competition, is considered to have a negative effect on exploration; that is, on innovation, growth, experimentation, search and entrepreneurship (see Table 1). Supporting and enhancing exploration is deemed important in order for an organisation to stay competitive in times of fierce competition (Sanders Jones & Linderman, 2014; Zhang et al., 2014).

4. Empirical findings

The report of the empirical findings starts with an account of how internal auditors operationalised PM and other process-related requirements in the MSS into the list of questions that they were planning to probe in the interviews. This is followed by a description of what adaptions the internal auditors made during the audit process, which was presented in the interviews, and finally the result of what type of PM practices were used in the six different audits (see Table 2).

4.1. Operationalisation of MSS requirements into list of questions

Two lists of questions, from Audits D and E in Table 2, have been reviewed in this study; below is a summary of some details from these two list of questions. In Audit D, which focused on the incubation process, several questions were asked about, for example, why Business Incubation is set up as an organisation, what it is expected to deliver, and to whom. Furthermore, in a section about team strategy and innovation strategy, questions were asked regarding how those strategies connect to the overall company strategy and the process for developing the team strategy. In another section about measurements, questions were asked regarding process measurements (such as the efficiency and effectiveness of the innovation process and whether innovation was generally successful within Electronics) and where to find records of measures and successfulness (that is, whether the organisation as such has been successful or not). There were also several questions about the innovation process itself, such as decision forums, risk management, authority and responsibilities and the consequences of different activities occurring or not occurring in the process.

In Audit E, which focused on the Service and Content Business Development process, there were also several different sections, such as responsibilities, scope and resources, governance, processes, business cases, development and optimisation, and strategy and planning. Questions asked in the area of responsibilities covered Business Developments responsibility and roles in regard to other interfacing organisations, how their responsibility differed from others, and why it was its own organisation rather than part of another organisation with similar objectives. Quite a few questions were asked related to governance; for example, regarding what key performance indicators were used, what decision forums the interviewees were part of, what criteria were used in decisions, and how decisions were prioritised, documented, and communicated. There were also questions about internal financial control. Regarding the process area, questions were asked about how continuous improvements are assured, how alignment to other processes was ensured, and what key decision points were set in the process and who the decision maker was. Finally, a few questions in the area of strategy were asked regarding how their roadmap and application portfolio looked, but also about their revenue plan.

4.2. Audit team adaptions during conducting audits

Five key informant interviews were conducted with lead auditors and auditors. Overall, the informants presented the different audits following the six steps in the audit process; see Figure 1. As described in Section 3.2.2, audit reports from audits were reviewed and discussed in the interviews and several different adaptions were described by the informants. Generally, the adaptations made were merely characterised as being administrative and regarding practical matters, e.g. adjustments in time when the audit should be executed, who to involve in the audit, adjustments in classification of findings and discussions about what corrective actions to perform. However, in the discussion about Audit D, one of the informants described that that there had been a discussion within the audit team whether the ISO 9001 MSS was possible to apply or not and ‘if it was at all possible to audit them [Business Incubation] while it was an innovation process and how should one audit such a process’. Furthermore, also regarding Audit D, one informant also believed that the other auditor did not think that they should audit the parts of the process that they [Business Incubation] had not utilised. One informant also stated that the audit team skipped auditing the part about innovation and organisational culture. This was due to them not feeling that they had the tools to audit these parts. Finally, when stressing the question about if there were any specific adaptions in the area of PM requirements one informant answered ‘not really’.

In Audit E, on the question if the audit team adapted to the characteristics of the process one informant answered that

we did not understand the importance and what it [the process] was until during the audit […] we got a picture during the pre-meetings and that was in the back of our heads […] however we did not understand the focus […] we could have spent more time [meaning initial steps] but we did not.

Moreover, on the question about what could have been done differently in step 3 (conduct the audit), the informant stated that ‘it is easier to find evidence and to get a description in a more structured organisation, they have more to show […] the other one [Business Development] is not that concrete’. Finally, as one of the informants expressed, ‘we have a process [audit process], we follow that, but to be able to come through, we have to adapt to time, how much we interfere or not depending on the maturity of the audited organisation and their understanding […] we have our process but we need to adapt our behaviour’.

4.3. PM practices identified in audit reports

For each of the six processes in Table 2, audit reports were extracted from the audit system. Each of the audit findings was analysed using the data analysis tool (see Table 3). While similar findings were found in different audits, a summary of these are reported in column A of Table 4.

Table 4. Description of audit findings including PM practice classification.

A. Audit finding		B. Found in audit (see Table 2)						C. PM practice
No.	Description and ISO requirement reference	A	B	C	D	E	F
1	Process development and implementation guidelines are missing; implementation follow-up is not done (§5.5.2)						X	Design
2	No description of the development programme process; this process was not clear for some of the interviewees (§4.1a)		X					Design
3	Unclear process relating to development planning and how and what the company commit to customers (§4.1c)		X					Control
4	Authorities and responsibilities for process owner/manager and other process roles are unclear/not known/not agreed (§5.5.2)		X			X	X	Design
5	Description for the project lead does not fully capture responsibilities, competences and authorities, resulting in very different ways of working (§5.5.2)				X			Design
6	Process measurements (effectiveness and efficiency) are not in place in order to drive process continuous improvements (§4.1c)						X	Control
7	Processes defined but process efficiency is not evaluated (4.1e)	X						Control
8	There is a process measurement stated in the functional description (planning stability) – but it is not actively used or documented (§4.1e)		X				X	Control
9	Deliverables and actions were not described within the development planning process or any other process (§4.1a)		X					Design
10	By whom, when and how process deliverables should be reviewed is not documented (§4.1c)			X				Control
11	Tollgate documentation which is part of the process description is not in practice and members were not aware of it. Some expressed that the documentation is not useful as it looks right now (§4.1d)				X			Design
12	Process contributors were not familiar with the whole process, including roles and authorities (§5.5.2)		X					Design
13	Definition of receiver/customer of the deliverables missing (§4.1d)			X				Design
14	Plan for process alignment to SW transition including resources allocation is not yet defined (§4.1c)						X	Control
15	Business Incubation are not working systematically to capture feedback and reuse learning (§4.1c)				X			Control
16	Insufficient resources/discipline available to work with process management (§4.1d)		X			X		Design
17	No roll-out plan for processes improvements (§5.6.3)			X				Improve
18	There is no content on the planning process pages in intranet pages (§4.1d)		X					Design
19	Much of the information is not documented and dependent on individuals (§4.1d)					X		Design

Note: X = Found in audit.

In total, 23 findings related to PM were identified and analysed. Of these, one directly relates to the PM practice improvement (4%), 14 relate to PM practice design (61%) and 8 relate to PM practice control (35%).

5. Discussion

The empirical findings show that audit questions covering company mission, strategy, team strategy, innovation strategy, and governance were prepared to be asked. While Electronics’ is split into units that can be characterised as either exploitative or explorative, so called structural ambidexterity (Tushman & O’Reilly, 1996, 2002) audit questions about mission, strategies, and governance can be supportive for structural ambidexterity as they form a common foundation (Birkinshaw et al., 2016). However, it was also found that several audit questions were prepared about predictability and risk management. These questions represent typical exploitative attributes (March, 1991; O’Reilly & Tushman, 2004); exploitation is argued to drive incremental innovation and can have a crowding-out effect of the more explorative forms of innovation, and can also build resistance to change and stunt an organisations ability to adapt (Benner & Tushman, 2002; Terziovski & Guerrero, 2014). Furthermore, it was also found that several audit questions were prepared about process efficiency and effectiveness measurements, as were questions about the possible consequences if different activities do or do not take place in the process. These questions represent the PM practice ‘process control’. Enforcing practices like process control, in an explorative process operating in a competitive environment, is believed to have a negative effect on explorative attributes as innovation, instead the focus should be on the PM practice ‘process design’ (Sanders Jones & Linderman, 2014). Preparing questions, probing for conformance to typical exploitative attributes in an explorative process, indicates that internal auditors do not adapt PM requirements when planning audits of processes that are considered to be explorative. Furthermore, no specific measures were taken to adapt to the explorative process in focus. This suggests that internal auditors are utilising a one-size-fits-all approach when auditing PM practices. This is argued not to be beneficial and, instead PM practices should be customised in order to enhance efficiency and/or innovation (Sanders Jones & Linderman, 2014; Zhang et al., 2014; Ng et al., 2015).

The findings in Electronics’ audit reports show that internal auditors looked for evidence of conformance with MSS requirements driving the PM practice ‘process design’; for example, over-all process descriptions, identification of process interfaces, receivers of process deliverables, and process awareness. Such practices are believed to have a positive effect on organisations operating in an environment of fierce competition and with a high rate of product change (Sanders Jones & Linderman, 2014). However, several audit findings show evidence that auditors also looked for conformance to MSS requirements driving the PM practice ‘process control’, which has been argued to support exploitation and hinder exploration (Benner & Tushman, 2003). Looking for conformance to the PM practice ‘process control’ in explorative processes points towards that internal auditors do not adapt PM requirements when auditing processes that are considered to be explorative. Instead, exploitative attributes like efficiency and refinement should be separated from exploratory activities (Benner & Tushman, 2003) in order to be or become successful (Turner et al., 2013). Moreover, all organisations audited operate in a fiercely competitive environment and it has been argued that PM practices should focus on process design rather than on process control, while this activity will conserve processes and does not support implementation of new processes (Sanders Jones & Linderman, 2014).

The empirical findings also points towards a possible challenge being an internal auditor, in an ambidextrous organisation. It has been argued that it is important to balance the focus on exploitation and exploration (March, 1991; Sutcliffe et al., 2000; Smith & Tushman, 2005), i.e. ambidexterity (Duncan, 1976), in order to be successful at launching breakthrough products and services (Tushman, 1997; He & Wong, 2004; O’Reilly & Tushman, 2004; Smith & Tushman, 2005). It has further been argued that it is necessary to differentiate PM practises based upon the competition in the industry (Sanders Jones & Linderman, 2014). However, the results indicates that internal auditors may have a difficulty moving between exploitative and explorative processes; adapting PM requirements in the ISO 9001 MSS, at the same time as looking for conformance to the same.

The present study is limited to one company and the European part of its organisation. Future research could include multiple case studies in organisations in different competitive environments. To increase the validity of the study, future research of this case, could be based on similar interviews in other geographical parts of the organisation.

6. Conclusion

Correctly adapted PM supports both exploitation and exploration. By managing this, internal auditors can add value beyond verifying conformance to the MSS when auditing organisations or processes characterised as explorative. However, this study points towards that internal auditors apply ISO 9001 MSS requirements for process control, i.e. assuming exploitative processes, even though the audited organisations and processes were considered to be explorative and the environment fiercely competitive. This assumption can possibly origin in an absent understanding of exploitation and exploration, the differences between the two and the effects of PM. Moreover, this study indicates that it might be challenging for internal auditors to move between exploitative and explorative processes in an ambidextrous organization, especially when looking for conformance to the PM requirements in the ISO 9001 MSS. This somewhat obdurate behavior can have its genesis in an uncertainty about how broadly the ISO 9001 MSS requirements can be interpreted. In an increasingly competitive environment, and given that PM is a core requirement in the ISO 9001 MSS, it is vital that internal auditors are aware of the positive and negative effects of PM on exploitation and exploration to better support explorative processes. In order to increase the awareness, and support internal auditors in managing ambidextrous organisations, internal audit department managers should initiate discussions regarding what to think of when auditing different organizational settings and explorative process, but also consider the possibility for using diverse competencies in audit teams.

Disclosure statement

No potential conflict of interest was reported by the author.