Even DISCOVERING all the processes a company has demands a lot of time and effort. Even at medium granularity, a medium company can have over one hundred different processes. Discovering all of them, setting boundaries where one process ends and another starts, is a job for a Process Department (which may later map the processes that NEED to be mapped, based on ROI and Organizational Strategies) and analyze the processes and suggest improvements.
To want to map all processes in a company just for the sake of ISO is madness. For ISO, use very coarse granularity, resulting in macroprocesses and just call those "processes" and give them a documented procedure.
Roger,
Indeed, mapping all the processes in the system would be madness. Risk-based thinking prevails instead.
Top management, with due regard for their organization’s mission, determines the key processes (at 10,000ft) in the core process that converts the needs of customers into cash in the bank.
As a result of this they usually have:
1. An end to end core process flowchart showing the interactions between its customers and suppliers.
2. A list of key processes extracted from the core process.
3. The unique identity of each key process and the name of the best person to be its owner.
Each organization has at least one core process (or value stream) and the core process is sustained and improved by other key processes in the system. These may be called support processes and each of them is uniquely identified and assigned to a process owner.
The key processes (core and support) are captured/designed in deployment flowcharts (showing interactions at the job title level). These become the documented procedures and may link to existing method statements or instructions. Process Owners avoid getting into the weeds by recognizing that most if not all processes include more than one department or function and comprise many tasks; non-value adding tasks struggle to be included.
All they are doing is capturing a model of the way the system actually works (as it is). When compared with a standard a few controls or tasks may be missing from existing processes and even fewer processes may be missing from the system. By carefully designing, training and nurturing these new controls, tasks and processes the system can then improve itself; remembering, of course, that a process means work usually by a team of humans.
Again, with risk-based thinking we use the system to prioritize and bring about the necessary improvements.
In my experience it is better to listen and to help the system to improve itself than to re-engineer it.
John
PS: Project-driven organizations to some extent reinvent parts of their core process for each new project so construction companies, for example, may maintain a library of method statements which are used and further developed by the estimating team when costing for new bids and proposals.
Their corporate management system would show what is done and by whom. The management system describing how may be unnecessary for a competent team; again RBT prevails.