Control Self Assessment Practices

To evaluate internal control using the COSO criteria, an auditor must evaluate soft controls like "tone at the top", management philosophy and operating style and communications. Many soft controls are too subjective to be evaluate by an outside observer acting alone. In some cases, the onlyvalid measure of their effectiveness is employees' perceptions. For this reason, most of the new internal control evaluation practices have a strong elemnet of self-assessment. 

 

The guiding principle is that evaluating soft controls requires a partnership between auditors and their customers. Management and/or employees must share their knowledge and perceptions openly with the auditors. Auditors must use an approach that poster openness and has the analytical discipline to turn subjective perceptions into legitimate audit evidence. The best-known self assessment practise - sometimes called "classic" self-assessment - is the Control Self Assessment (CSA) workshop. With this technique, first-line employees participate in a wokshop. The facilitator guides them through an assessment of control strenghts and weaknesses, and they develop action plans for improvement. 

 

The CSA workshop is ene of the most important but it is certainty not the only one. The creative ferment provoked by the control models has produced a variety of self-assessment practices. Self-Assessment practices, grouped according to level of application: entity-wide, business unit/process, and work team. Within each group, practices proceed roughly from the most comprehensive (therefore resources-intensive, perhaps more applicable to large organizations) to the most accesible. 

 

Entity-Wide Applications  

When Audit institutions consider their scope of work in light of the COSO components, they often find they are lacking in coverage of the Control Environment and those Risk Assessment, Communication, and Monitoring activities which senior management carries out for the organization as a whole. This gap is not surprising. Internal audits are typically performed on one "auditable entity" at a time. 

 

Auditors naturally focus on controls specific to that entity, not on organization-wide controlling processes. The obvious way to fill this gap is to perform an organization-wide review of the Control Environment and other high level management controls. Most entity-wide reviews are performed using a questionnaire/interview format (Component Evaluation Tool). 

 

Business Unit/Process Applications  

In some organizations, high-level management controls are most meaningfully evaluated at the business unit or process level. Each units had its own control environment, so the focus of evaluation should be the business unit. 

 

Work Team Application 

The practices we have seen above could be called "mangement self-assessment". They are execellent tools for evaluating high-level controls from management's prespective. However, there are times when conscientious managers are doing ( or think they are doing) the righ thing, and employees perceive it diffrently. To identify this kind of control breakdown, first-line employees must be involved in the self-assessment. Besides evidencing the effectiveness of high-level management controls, work-team self-assessment provides the opportunity for collaborative, in-dept analysis of the team's specific objectives, risk, and control activities. The best known self-assessment practice is the Control Self Assessment workshop conducted within a work team.