Expert verified
Organisations lose nearly 5% of revenue to fraud each year and this figure has remained broadly consistent across nearly three decades of global studies.
But fraud is only part of the problem. Pricing errors, unauthorised discounts, duplicate vendor payments, and collections that stop at one location can create equally costly losses. Unlike fraud, these show up as slightly worse numbers, month after month, until someone asks why.
This blog takes you through seven specific signals that reveal where multi-location process problems surface and what to do when you find them.
The Hidden Cost of Multi-Location Process Drift
Process drift is a natural consequence of growth.
When a business operates from one location, processes tend to stay aligned because people work within the same systems, management structure, and operating environment. When you add more plants, warehouses, branches, or regional offices, local variations begin to appear.
A branch manager may change an approval step to serve a regular customer faster. A plant supervisor may introduce a spreadsheet during an ERP issue and continue using it after the system is restored. A local team may create a workaround because the group’s approval hierarchy no longer fits the site’s transaction volume. These decisions may not look serious on their own but they become a problem when these small adjustments accumulate across locations.
A 2% margin difference at one branch may be dismissed as local performance variation. A three-day delay in order processing may appear to be a warehouse issue. But when similar gaps exist across several locations, the combined effect can cumulatively affect working capital, margins, control effectiveness, and compliance risk.
There is also the loss of confidence in location-level information. The head office starts requesting additional reconciliations, explanations, and manual reports because it cannot rely on operational data being produced consistently. Decisions slow down, management oversight becomes more expensive, and local teams spend increasing amounts of time responding to central queries.
The seven signals below are designed to help you identify whether process drift has reached a level where a structured multi-location process audit will produce more value than another round of internal memos.
Signal 1: Inconsistent Process Outcomes Across Locations
The most reliable indicator of process drift is when the same process produces different outcomes at different locations without a legitimate business reason.
A purchase order for the same category of material takes 3 days to approve at one plant and 10 days at another. A month-end reconciliation closes by day 3 at one warehouse but remains open on day 13 at another. Return rates, rejection rates, discount approvals, or payment processing times show significant differences between otherwise comparable locations.
The problem is that these differences often disappear inside local reporting. Each location may be measured against its own target, making both Plant A and Plant B appear to be performing within expectations. The group therefore sees several acceptable results instead of one clear comparison showing that the same process is operating very differently.
System configuration can make the problem worse. For example, a mid-sized auto components manufacturer with four plants in Maharashtra discovered during a process audit that the same approval workflow in its SAP system had been configured differently at each plant. One plant had a two-level approval hierarchy, another had four levels, and two plants had manual overrides that bypassed the workflow entirely. No one had compared the configurations since the system was rolled out. The result was an average 4.7-day difference in procurement cycle time across plants, with a direct impact on working capital.
See if you put the process metrics from all your locations side by side for the same process, would you be able to explain every variance? If not, process drift is present and warrants deeper audit testing.
Signal 2: Escalating Audit Findings
Consider a logistics company with operations in six cities. An internal audit identified a segregation of duties gap in vendor master creation at the Mumbai hub. The finding was closed after the Mumbai team implemented a maker-checker control. 12 months later, the same finding was raised at the Pune hub. 6 months after that, at the Hyderabad hub. Each closure was treated as a local remediation.
No one asked whether the process design itself allowed the gap to recur, or whether the fix applied in Mumbai could be standardised across all hubs.
The problem is not necessarily that the first remediation failed. The deeper issue is that the underlying process was never assessed across the wider organisation. Each location was treated as a separate audit rather than as another instance of the same group process.
This creates a predictable cycle. Audit identifies the problem, the local team fixes it, the finding is closed, and the same control weakness eventually appears somewhere else. Management sees a series of unrelated findings when it is actually dealing with one recurring process-design or implementation problem.
Look beyond the total number of findings. Track recurrence, location, root cause, and time between findings. Ask whether a finding raised at one location should trigger a review at every other location running the same process.
Here’s a rule to follow:
- One location: investigate the control failure.
- Multiple locations: investigate the process design.
- Recurring after remediation: investigate the governance and remediation process itself.
If findings keep moving from one location to another, the audit function may be treating symptoms instead of addressing process drift at its source.
Signal 3: Revenue Leakage in Specific Locations
Revenue leakage in multi-location operations often come from small process gaps that appear unimportant at one location but become significant when they continue for months.
Indian retail chains operating multiple outlets without unified management systems lose between 12% and 18% of potential revenue to operational blind spots. While this figure is specific to retail, the underlying mechanism applies to any multi-location operation: when each location operates with its own version of the process, the group loses visibility into where revenue is leaking.
The warning sign is a persistent financial performance gap between otherwise comparable locations. One branch consistently records lower realisation, higher claim rejection, weaker collections, higher credit notes, or lower margins than similar locations.
Management may attribute the difference to local competition, customer mix, pricing conditions, or a newer team. Sometimes those explanations are valid but an unexplained and recurring gap should also be treated as a process risk.
For example, if one service centre’s realisation rate remains several percentage points below comparable centres, the audit should trace the difference back through pricing, discounts, billing approvals, service records, and invoicing. The cause may turn out to be a local process variation rather than the market conditions initially assumed.
See if you can explain the financial performance difference between comparable locations using evidence from the underlying process.
If the answer is no, do not accept the variance as a normal location-level difference. Trace the transaction flow and test where value is being lost.
Signal 4: Compliance Variation by Site
Compliance risk is rarely distributed evenly across a multi-location business. It tends to surface where local management has greater discretion, ownership is unclear, or central monitoring is weaker.
What needs to be checked is whether compliance processes are applied consistently, with local variations properly identified and controlled. A recurring compliance gap at the same location is a warning sign.
India’s regulatory framework comprises more than 1,500 Acts and Rules, requiring adherence to thousands of statutory compliance obligations.For a multi-location enterprise, this regulatory complexity multiplies by the number of locations.
A GST compliance process that works in Maharashtra may have a different requirement in Tamil Nadu. A labour law compliance framework that covers permanent employees may miss contract labour obligations, which are particularly significant: contractors often account for 40% to 70% of the workforce at industrial establishments, yet contractor compliance remains insufficiently monitored.
Here’s a scenario: a multi-state infrastructure company discovered during a process audit that its GST TDS deductions were being reported under a single state code for a project that spanned two states. The issue had persisted for eight months, creating a compliance exposure that neither the project finance team nor the corporate tax team had identified because each assumed the other was handling the inter-state reporting requirement.
The audit should therefore compare compliance calendars, ownership, evidence, escalation procedures, and renewal controls across locations. State-specific requirements should be recognised, but differences in compliance discipline should have a clear explanation.
Signal 5: High Coordination Overhead Between Sites
Coordination overhead is one of the less visible costs of multi-location process fragmentation. It appears when head office teams spend increasing amounts of time reconciling data, resolving location-level differences, and translating local processes into a format the wider organisation can use.
A common pattern is month-end close. Finance may need to contact several locations to understand why transactions are categorised differently, manually reconcile inter-location transfers, or request additional schedules before consolidated numbers can be prepared. Operations may face a similar problem when each plant uses a different resource-planning method or tracking tool.
Consider a logistics business operating eight hubs. Its finance controller had to personally reconcile inter-hub transfer entries every month because each hub recorded transfers using a slightly different account structure. A process that should have been largely routine became a recurring two-to-three-day manual exercise, consuming senior finance time that could have been used for analysis and decision-making.
Some central oversight is expected in a multi-location business but the warning sign is when the head office repeatedly performs manual work simply to make location-level information comparable.
Check: how much time does your finance or operations team spend each month reconciling, translating, or clarifying location-level data before it can be consolidated?
If that effort is increasing without a corresponding increase in genuine business complexity, it may indicate fragmented processes, inconsistent data structures, or unclear group standards.
A process audit can identify where standardisation would reduce this coordination tax and return central teams to higher-value analysis.
Signal 6: Local Process Owners Bypassing Standards
A strong warning sign of process drift is when local process owners regularly modify or bypass group standards without formal approval. The reason is often understandable. A central process may be too slow, poorly suited to local conditions, or no longer aligned with how the business operates. But once an informal workaround becomes the accepted process, the organisation has a control gap.
Common bypass patterns in Indian multi-location enterprises include local purchase managers creating vendor codes without central approval because onboarding takes too long, plant heads using approval limits outside the formal Delegation of Authority, or regional sales teams offering pricing exceptions because the standard workflow cannot accommodate legitimate market variations.
Consider a manufacturing group with six plants where three locations created temporary procurement approval matrices after a leadership change. The group DOA had not been updated, so local teams introduced workarounds to keep purchasing moving. Eighteen months later, those matrices were still being used, and the central finance team was unaware of them until an audit identified the gap.
The important point is that the workaround may be locally rational and still represent a control weakness. The question is not simply why employees bypassed the standard, but why the deviation was needed and why it remained undocumented.
What you need to check: do you have a mechanism to detect when a local process deviates from the group standard, and do you have a process for reviewing whether the deviation should be approved, standardised, or corrected? If deviations are discovered only through audits, you are managing process drift reactively.
Signal 7: M&A or New Site Integration Without Process Audit
Acquisitions and new site openings are major triggers for process drift because they introduce new teams, systems, and operating practices into an existing process framework. Financial and legal due diligence may be thorough, while process and control due diligence receives less attention.
A mid-cap pharma company acquired a formulations manufacturing unit in Himachal Pradesh to expand its capacity. The acquisition due diligence covered financials, regulatory approvals, and product portfolio. It did not cover the acquired unit’s procurement process, vendor qualification framework, or internal control environment.
Six months after the acquisition, the group’s internal audit team found that the acquired unit had no segregation of duties in its vendor payment process, no documented procurement approval matrix, and no formal vendor qualification records for 40% of its active vendors. These were not hidden issues. They had simply never been assessed because the acquisition integration plan focused on financial consolidation and regulatory compliance, not on process integration.
The same pattern occurs with new site additions. A retail chain opens a new store in a tier-II city. The store is set up with a local team, local processes, and local reporting. The group’s standard operating procedures are shared as a document but not implemented with structured training and verification. Within six months, the store has developed its own way of doing things, and the group has no visibility into whether that way complies with the standard.
Find out for every acquisition or new site added in the last 24 months, can you demonstrate that a process and control assessment was conducted, findings were documented, and remediation was completed?
If not, the process integration risk is unquantified.
What to Do When You See Three or More Signals
One signal in isolation may simply indicate normal location-level variation. Three or more signals, particularly when they cluster around the same locations, deserve a more structured response.
That does not mean that you need a full-scale audit immediately. Start with a focused scoping exercise to identify where process drift is concentrated and what a targeted audit should cover.
Start by mapping the signals against specific locations.
You may find that the same two or three sites repeatedly appear across inconsistent outcomes, compliance delays, revenue leakage, or local workarounds, while other locations remain stable. This helps management focus resources where the risk is highest.
The next step is to establish a baseline.
Review the documented group standard, collect process evidence from representative locations, and conduct walkthroughs with local process owners. Compare what the process is supposed to look like with how it actually operates. The objective is to identify whether multiple signals have a common root cause.
For example, a local approval workaround and recurring compliance delays may both stem from unclear ownership or a group SOP that was never adapted to the site’s operating reality. Addressing the underlying process issue is more effective than treating each symptom separately.
The output should be a prioritised audit scope, covering:
- Key control gaps
- Areas of process drift
- Preliminary financial, operational, or compliance exposure
The goal is not to find fault with local teams. Process drift is often a structural consequence of growth.
A well-scoped process audit helps management restore consistency before those differences become larger business problems.
PKC’s Multi-Location Audit Approach
PKC’s process audit methodology for multi-location enterprises is built around three steps: walkthrough, testing, and cross-location benchmarking.
Walkthrough
This step involves sitting with the people who actually perform the process at each location and observing how the work is done, not how it is documented.
This surfaces the manual workarounds, the informal approvals, and the local adaptations that never appear in SOPs. It is the only way to understand what is really happening versus what is supposed to happen.
Testing
The testing step applies control tests to verify whether the key controls in each process are operating effectively. This includes transaction testing, system configuration review, and evidence verification.
The testing is designed to produce findings that are specific enough to be actionable, not generic observations about “process improvement opportunities.”
Benchmarking
It compares the process outcomes across locations. Cycle times, exception rates, control failure rates, and cost metrics are compared side by side.
The benchmarking output is what turns a collection of location-specific findings into a group-level view of where the process standard is being met, where it is being missed, and where the standard itself may need to be revised.
PKC’s engagements are scoped to produce a prioritised remediation roadmap that the COO or CFO can act on, rather than a generic findings report. The roadmap identifies which gaps are quick wins, which require system changes, and which require process redesign. It also identifies which fixes should be implemented at the group level and which can be handled locally.
For organisations with internal audit capacity, PKC can provide the framework, benchmarking methodology, and quality review while the internal team executes the location-level work.
For organisations without that capacity, we execute the full audit programme across locations. The engagement is designed to build internal capability over time, not to create dependency.
If three or more of these signals sound familiar, the gap is already costing you more than it would cost to find it properly. Schedule a Process Audit Diagnostic with PKC to discuss what a process audit built around your specific locations would look like.
FAQs
How many locations does a business need before process drift becomes a real risk?
There’s no fixed threshold, but the risk typically becomes material once a business operates from three or more sites, or once any single process is handled by more than one team without a shared, actively maintained standard governing it.
Can process drift exist even if every location is individually profitable?
Yes. A location can be profitable in absolute terms while still underperforming what it should achieve given its size and footfall, which is exactly the pattern Signal 3 describes, and profitability alone doesn’t rule out a control or compliance gap that simply hasn’t caused visible damage yet.
Will a process audit disrupt our operations?
A well-scoped process audit is designed to minimise disruption. The walkthrough and testing activities are typically conducted over two to three days per location, with advance scheduling and minimal involvement from operational staff. The data collection can often be done remotely where systems allow. PKC’s approach is to work with local teams to schedule audit activities around their operational priorities, not to impose a fixed audit calendar that disrupts production or service delivery.
Can our internal audit team handle a multi-location process audit without external support?
It depends on the team’s capacity and the geographic spread of your locations. Internal teams can execute the location-level testing if they have a standardised methodology and a benchmarking framework. The challenge is usually the cross-location comparison and the independence of findings. An external audit partner can provide the benchmarking methodology and the objectivity to report findings that internal teams may be reluctant to escalate.
How long does a focused, multi-location process audit take?
It depends on how many locations and processes are in scope, but a focused review targeting the two or three locations where signals have clustered typically moves faster than a full group-wide audit, since the diagnostic work narrows the fieldwork rather than spreading it evenly across every site regardless of risk.
