audit report - inventory systems synchronization assessment draft 10-8-14

___________________________________________

**DRAFT** Internal Audit Report

Inventory Systems Synchronization Assessment

___________________________________________

This report contains confidential information and should not be shared with anyone except REI’s Board, senior management and the external auditors.

of 19

September 24, 2014


of 19

Recreational Equipment, Inc.


Internal Audit Report

EXECUTIVE SUMMARY

BACKGROUND

The Internal Audit department (“IA”) conducted an audit of the systems, interfaces and synchronization activities, both programmed and manual, involved in the management of REI operational inventory. Operational inventory is the inventory that is immediately available for customer order fulfillment and store replenishment. It is based on available supply—merchandise on-hand at distribution centers (DCs) and retail stores, receipts and returns—and demand—retail and direct sales, pre-allocations for events, high demand and backordered merchandise, and allocations to stores for inventory replenishment. Supply is primarily managed by SAP and the Warehouse Management System (“WM”) and demand comes from multiple systems—SAP, WM, Sterling Order Management System (“Sterling”) and Advanced Store Replenishment (“ASR”). Three additional systems are involved in the management of operational inventory—Product Availability and Reservation (“PAR”), Inventory Movement Tracking (“IMT”) and AS400 Data Store (“ADS”). These are internally developed legacy systems required by ASR that also have interfaces of supply and demand data and automated synchronization processes with SAP, WM and Sterling.

Discrepancies between the systems of record for inventory quantities (WM) and account balances (SAP) occur on an ongoing basis and require manual adjustments to inventory performed in conjunction with the Finance department in order to correct the variances between systems. These adjustments have resulted in substantial shrinkage costs and operational disruptions, and led to the development of a dedicated Inventory Optimization Team, This team is comprised of a supervisor in inventory accounting and senior architects, engineers and analysts from multiple groups within the IT organization, each of which participate in ongoing root cause analysis and maintenance of inventory accuracy through manual efforts—a function that is entirely separate from their defined roles and job responsibilities.

Despite the considerable utilization of personnel and IT resources, WM and SAP continue to have significant variances, resulting in ongoing inventory adjustments attributed to systems synchronization issues. These adjustments represent a shrinkage expenditure of over $430,000 YTD through August and almost $1.9 million since the implementation of SAP in August 2010.


of 19

AUDIT OBJECTIVE

The objectives of the audit were to gain an overall understanding of the various systems, interfaces and synchronization programs in place that can impact inventory quantities, identify relevant Process Owners for each of these components and assess the effectiveness of the co-op’s procedures and processes for identifying and resolving discrepancies in inventory data reported from these systems.

AUDIT SCOPE

The scope of audit procedures included the following review areas:

Understand and document systems that impact inventory, as well as related interfaces and synchronization activities, both programmed and manual. Assess governance for the flow of inventory and related systems and synchronization activities, and identify Business Process Owners for each of these components. Evaluate the process and system design, as well as current reporting, monitoring and reconciliation activities related to inventory data discrepancies.

IA conducted field work from May 15th, 2014 through August 29th, 2014. Audit procedures consisted of interviews with key personnel, performing walkthroughs of control processes and inspecting technical configurations and supporting documentation for each of the review areas, systems and interfaces supporting the management of operational inventory. Our work was performed in accordance with the International Standards for the Professional Practice of Internal Auditing and testing activities were based on established best practice frameworks, such as COSO, ITIL and COBIT, for each review area in scope.


of 19

CONCLUSION

The observations noted during audit fieldwork indicate opportunities where improvements in the design and operation of systems and control processes supporting operational inventory management will:

Reduce inventory variances, operational disruptions and the resources required to maintain inventory accuracy

Enable more timely and effective resolution of inventory synchronization issues

Position REI for more successful management and execution of projects such as SIF or future investments in distribution centers by improving the ongoing scalability of REI’s environment.

The observations noted during the audit are summarized into the themes below.

1. System Architecture and Operation

Management of operational inventory is highly complex, involving seven independent systems and over 40 interfaces encompassing a range of technology platforms and acquired, third party and internally developed solutions that have been customized over time, rather than decommissioned or replaced. The architectural complexity of systems, interfaces and synchronization processes greatly increases the likelihood of variances between systems and makes root cause analysis and resolution of discrepancies more difficult, increasing the personnel time and resources required to maintain the accuracy of operational inventory. The system design also lacks automated synchronization of certain types of data flows, such as WM and SAP demand data, resulting in ongoing manual effort required to correct the variances. In addition, there are unresolved flaws in application logic and interface processes causing repeated communication failures between SAP and other systems, as well as unintended behavior of certain systems when processing transactions that create operational disruptions and require manual efforts to resolve, further extending personnel time and resources.

2. Process Governance

The overall process and activities involved in root cause analysis and reconciliation of inventory synchronization issues is not formally defined. Management has not established policies and procedures governing the synchronization activities and roles and responsibilities of individuals involved in maintaining the accuracy of operational inventory. In addition, a formal systems development methodology and related development, testing, documentation and approval requirements is not in place. This is compounded by highly constrained personnel resources available to perform critical development and quality assurance activities, such as:

Documentation of detailed specifications for proposed solutions


of 19

Formal review and approval of design documents and development plans

Developer code reviews

Independent quality assurance testing prior to user acceptance

Ongoing measurement and monitoring of the success of development and remediation activities

3. Monitoring and Reporting

The process for monitoring inventory variances between WM and SAP is a weekly comparison that runs on Saturday evening and distributes a list of the articles, locations and quantities of inventory as reported by WM and SAP at that time, and the associated variance quantities and cost for each article in the report. This comparison process does not currently check or report variances of certain categories of inventory in SAP that are assumed to have no financial impact. The omission of these inventory categories diminishes visibility of synchronization issues that may provide insight as to sources of variances and lead to more effective root cause analysis. In addition, a process is not in place to formally track synchronization issues and resolution activities over time or retain documentation of previously identified root causes and the associated steps involved in testing and verifying the sources of variances and corrective actions taken, recognized patterns of self-correcting variances or business scenarios and events known to cause a disproportionate increase in the variances reported that week. The root cause analysis and solution identification process currently requires highly specialized experience and in-depth knowledge of the environment, which significantly diminishes cross-training capabilities and transferability of skills required to assist in reconciliation of inventory systems synchronization issues.


of 19

MANAGEMENT RESPONSE

We appreciate the effort and prolonged partnership with Internal Audit on our effort to improve our inventory accuracy. The more significant system related findings will require a capital ask during the 2015 budgeting process. As such, Supply Chain Systems will partner with cross functional IT teams including SAP and Sterling teams to create opportunity statements, solution approaches, estimates, KPI’s and KPI targets and submit them into the 2015 IT Portfolio Planning process to be evaluated against all other initiatives for priority for 2015.

In a separate, and more near term work stream, the Supply Chain Systems team will perform an internal review and recommendations document regarding process and organizational changes called out in this audit.

OBSERVATION SUMMARY

The table below is a summary of audit observations and ratings for each theme identified during the audit.

Themes IdentifiedObservations & Ratings

High Medium Low

System Architecture and Operation 1 2 0

Process Governance 1 3 0

Monitoring and Reporting 0 2 0

Totals 2 7 0

Ratings Definitions


of 19

HighThe observations highlight non-existent or ineffective organizational, process, and/or systematic controls. The observations, if left unaddressed, could increase financial, legal, and/or operational risks to the co-op.

Medium While the observations may not have significant internal control impact, they may expose the co-op to some financial and/or operational risks.

Low Observations are isolated and/or minor. Observations could also be intended to assist management in improving operational efficiency and effectiveness.

OBSERVATION SUMMARY CONT’D

# Observation Rating OwnerEstimated Completion Date

System Architecture and Operation

1 Complexity HighDerek Chaves, Director of Network Fulfillment Supply Chain Systems Delivery

QX-201X

2 Automated Data Flows MediumDerek Chaves, Director of Network Fulfillment Supply Chain Systems Delivery

QX-201X

3 Communications Failures MediumDerek Chaves, Director of Network Fulfillment Supply Chain Systems Delivery

QX-201X

Process Governance

4Policies and Procedures / Roles and Responsibilities

MediumDerek Chaves, Director of Network Fulfillment Supply Chain Systems Delivery

QX-201X

5Resource Availability and Utilization

HighDerek Chaves, Director of Network Fulfillment Supply Chain Systems Delivery

QX-201X

6Systems Development Methodology


QX-201X

7 Systems Documentation MediumDerek Chaves, Director of Network Fulfillment Supply Chain Systems Delivery

QX-201X

Monitoring and Reporting

8 Inventory Variance Medium Derek Chaves, Director of Network Fulfillment QX-201X


of 19

Reporting Supply Chain Systems Delivery

9Trending of Variance Root Causes and Corrections


QX-201X


of 19


Observation Detail – 9/24/2014

Observation Management Action Plan

System Architecture and Operation – Complexity

Risk: High

Seven independent systems and over 40 interfaces involved in the management of operational inventory creates an architectural complexity that greatly increases the likelihood of variances between systems and makes root cause analysis and resolution of discrepancies more difficult, increasing the personnel time and resources required to maintain the accuracy of operational inventory. The primary systems of record for inventory quantities and valuation (WM and SAP) currently rely on legacy processes and systems that were originally slated for retirement when SAP was implemented. Three of the systems (PAR, IMT and ADS) and over half of the interfaces are required to support ASR. In addition, the SAP allocations process for push allocations to stores and the WM Velocity demand process also currently rely on PAR, adding to the complexity of the solution.

IA recommends that management approve, provide funding and allocate personnel resources to commence the initial discovery phase of the proposed Operational Inventory Optimization Project. The discovery phase would identify data and timing gaps that would exist between our systems of record and legacy systems if they were to be decommissioned, facilitating the planning, design and estimated cost and duration of the remediation efforts required to reduce the complexity of operational inventory management and eliminate reliance on legacy systems. The requested funding and estimated cost of the discovery phase represents a

Management Response / Action Plan:

Owner: Derek Chaves, Director of Network Fulfillment Supply Chain Systems Delivery

Implementation Date:


of 19



fraction of the cost attributed to inventory shrinkage resulting from systems synchronization issues this year.

System Architecture and Operation – Automated Data Flows

Risk: Medium

The current architecture of systems involved in operational inventory management lacks automated synchronization of certain types of data flows, resulting in ongoing manual effort required to correct the variances. Automated synchronization of supply data exists between the systems that maintain it, but there is no automated synchronization of demand between WM and SAP, resulting in ongoing manual effort to correct drift of operational inventory.

Management should initiate planning and estimation of the time and personnel resources required for creating demand synchronization processes between WM and SAP, modifying the SAP-Sterling supply synchronization processes to align with SAP-WM supply synchronization processes, and resolving the timing issues present in certain interfaces between WM and SAP.




System Architecture and Operation – Communications Failures

Risk: Medium

There are unresolved flaws in application logic and interface processes causing repeated iDoc failures to and from SAP. In addition, there is unintended behavior of certain systems when processing transactions and timing issues present in some of the interfaces between WM and SAP.



of 19



These create operational disruptions and require manual efforts to resolve, further extending personnel time and resources.

Management should conduct root cause analysis and remediation of issues that result in manual iDoc processing in SAP required to maintain operational inventory accuracy, as well as examine and remediate the timing issues present in interfaces between WM and SAP.



Process Governance – Policies and Procedures / Roles and Responsibilities

Risk: Medium

Currently, Inventory Accounting substantially relies on the analysis conducted by IT in order to quantify the valuation of adjustments made due to inventory systems synchronization issues. In addition, the Inventory Optimization Team currently operates on a largely informal basis, although efforts are coordinated and there is a general process followed for identifying and addressing inventory variances. A lack of established policies and procedures governing the root cause analysis process, synchronization activities and roles and responsibilities:

Diminishes cross-training capabilities and transferability of skills

Prevents optimal utilization of new and currently available personnel resources

Requires highly specialized experience and in-depth knowledge of the environment to effectively contribute to the root cause analysis





of 19



and solution identification process.

Management should establish policy and procedural documentation describing the root cause analysis process and activities involved in resolving inventory synchronization issues, previously identified root causes and business scenarios that create inventory variances, known patterns of self-correcting inventory variances, as well as the steps followed during previous root cause analyses and the associated corrective actions taken. The policy documentation should be updated regularly and utilized to cross-train other members of the Inventory Optimization Team, as well as other qualified and available IT personnel as deemed appropriate by management.

Process Governance – Resource Availability and Utilization

Risk: High

IA attended the weekly Inventory Optimization Team meetings throughout the duration of this audit, and noted that there appears to be a significant limitation in available personnel qualified to assist in the design, development, testing or acceptance of changes implemented to resolve inventory synchronization issues. Due to the highly constrained available resources, there are critical functions related to solution design, development and quality assurance that are not consistently performed, such as documentation of detailed specifications for proposed solutions, formal review and approval of design documents and development plans, developer code reviews, independent quality assurance testing prior to user acceptance, and ongoing measurement and monitoring of the success of development and remediation activities.





of 19



These issues have led to instances where solutions developed to address inventory synchronization issues inadvertently introduced technical errors and data discrepancies into the production environment, as there was a lack of independent validation of development efforts, test cases and results prior to implementation. In turn, this leads to increased demands on already over-extended personnel and increases the risk that changes will be implemented in the production environment that do not operate as intended, which may lead to additional complications and inventory variances if not identified timely.

Management should actively seek fulfillment of an independent quality assurance function for changes to WM, related interfaces and legacy systems. The SAP COE has a dedicated Quality Assurance group, and this function was leveraged in the past for developed changes to WM, but these resources were re-assigned after the acquisition of the Bedford DC, and currently there are no plans to add WM to the QA in-scope systems. In addition, management should establish a process of cross-training and transfer of knowledge and skills required to design or validate test cases and results, create datasets that accurately validate the logic of the proposed solution during testing, document and communicate QA test results and exceptions, and assist with the design and verification of proposed solutions.


of 19



Process Governance – Systems Development Methodology

Risk: Medium

Management has not established a formal methodology and documented policies and procedures governing systems development and change management activities. Systems development and change management policy documentation is limited to high-level process flow diagrams of the Waypoint production control process for migrating changes to the production environment. This increases the risk that solution design, project initiation and related development, testing, quality assurance and user acceptance activities will not be executed in a consistent manner in alignment with organizational goals, best practices or established standards. In addition, without a defined systems development and change management methodology in place, there is less assurance that changes to critical systems will be properly authorized, approved, implemented and documented.

Management should establish formal policies and procedures governing the development and management of changes, including:

Documentation and approval requirements for proposed solutions

Review activities and approvals required to initiate development

Development environments, coding standards, version control and change migration systems involved in systems development

Developer testing activities, independent code reviews and





of 19



approval requirements for migration to the QA environment

Review and approval of proposed test cases and datasets utilized for QA testing

Independent verification of test cases, data and results prior to implementation in production

Documentation and approval requirements for migration to the production environment

Process Governance – Systems Documentation

Risk: Medium

Technical documentation related to the systems, interfaces and data flows involved in operational inventory management lacks detailed design and technical specifications and is not maintained in a current state, consistent format or centralized repository. This creates additional dependence on senior individuals with highly specialized experience and in-depth knowledge of the environment, increases the risk of configuration documentation failing to reflect current system configuration, reduces transferability of skills and impairs management’s ability to train or acquire qualified personnel resources to augment the over-extended team of individuals involved in maintaining the accuracy of operational inventory.

Management should establish an agreed-upon and standardized approach for documenting system and interface functional specifications and a process for ensuring that system documentation is updated whenever





of 19



changes are implemented that affect one of these components, including:

Business process requirements and overall solution design (high level process overview / business driver / assumptions)

Systems, programs, tables and interfaces involved

Programming nature for interface solutions, including data types, programming language and feeds to other systems

Processing logic and output

Monitoring and Reporting – Inventory Variance Reporting

Risk: Medium

The WM-SAP weekly variance reporting process does not include certain categories of inventory in SAP in its synchronization check, which diminishes visibility of synchronization issues that may provide insight as to sources of variances and lead to more effective root cause analysis. Specifically, Goods Receipt Valuated Blocked Stock (GRVB) and Sales Order Stock are not sent to SAP for synchronization validation and are omitted from the distributed report. Discussions with the Inventory Optimization Team indicated that capturing variances in GRVB Stock would be meaningful and help enable the identification of patterns and scenarios causing ongoing synchronization issues.

Management should examine the current WM-SAP variance reporting process logic and evaluate the efforts required to add GRVB Stock to the synchronization check and distributed report, as well as appropriate timing





of 19



considerations for the process redesign, testing and implementation, considering the required resources and personnel availability.

Monitoring and Reporting – Trending of Variance Root Causes and Corrections

Risk: Medium

A process is not in place to formally track synchronization issues and resolution activities over time or retain documentation of previously identified root causes and the associated steps involved in testing and verifying the sources of variances and corrective actions taken, recognized patterns of self-correcting variances or business scenarios and events known to cause a disproportionate increase in the variances reported that week. The root cause analysis and solution identification process currently requires highly specialized experience and in-depth knowledge of the environment, which significantly diminishes cross-training capabilities and transferability of skills required to assist in reconciliation of inventory systems synchronization issues.

In conjunction with the assignment of authority, roles and responsibilities of the Inventory Optimization Team and Inventory Accounting, management should define a process and documented procedure establishing a centrally maintained log of identified root causes, business scenarios and known patterns of self-correcting inventory variances, as well as the steps followed during the root cause analysis activities and the associated corrective actions taken. The log should be maintained separately from the Waypoint ticketing system, and should be updated as variance root causes are identified and utilized to cross-train other members of the Inventory Optimization Team, as well as other qualified





of 19



and available IT personnel as deemed appropriate by management.


of 19

audit report - inventory systems synchronization assessment draft 10-8-14

Documents