The Use of Control Self-Assessment by Independent Auditors

Control self-assessment (CSA) is an effective tool for improving a business’ internal controls and business processes. CSA can be implemented in several ways, but its distinguishing feature is that risk assessments and internal control evaluations are made by operational employees or lower-level managers who work in the area being evaluated. 

CSA activities also have the potential to improve the efficiency and effectiveness of independent financial statement audits in response to changing demands on independent auditors. While independent auditors can benefit from CSA activities, little evidence indicates the extent to which independent auditors avail themselves of these benefits.

The authors investigated the uses of CSA by independent auditors, as well as the perceptions about the value of independent-auditor involvement with CSA activities. Approaches to CSA The Institute of Internal Auditors (IIA) defines CSA as a process through which internal control effectiveness is examined with the objective of providing reasonable assurance that all business objectives are met. 

The employees performing CSA work are in the functional area being examined rather than upper-level managers that are above the system of internal controls. These employees have a wealth of information about internal controls and fraud (if it exists). While internal (or independent) auditors can be involved with CSA initiatives, auditors do not “own” the process and do not make the assessments and evaluations.

The most common approaches to performing CSA activities are facilitated team meetings and CSA surveys. 

• Facilitated team meetings are the most popular form of CSA. The facilitated sessions consist of six to 15 employees who are subject on a day-to-day basis to the internal controls being evaluated. A trained facilitator guides the meeting, and another individual records the activity. Anonymity can be promoted by using “groupware” software. 

• The survey approach uses questionnaires to elicit data about controls, risks, and processes. It differs from traditional internal control questionnaires used by auditors because the operational employees (not the auditors) use the survey results to self-evaluate the controls or processes. 

Relevant Experiences of the Internal Auditing Profession 

The internal auditing profession has widely embraced the use of CSA. The IIA supports internal auditors who use CSA to achieve internal auditing objectives and recognized the importance of CSA by creating a Control Self-Assessment Center. The IIA does not prohibit internal-auditor participation in the CSA activities of auditees due to independence concerns, and in practice, organizations have not had independence issues when internal auditors have participated in a variety of ways (e.g., as facilitators of CSA meetings). 

Members of the internal auditing profession have considerable experience in successfully using CSA in the internal auditing process. These experiences are relevant to external auditors because they face many of the same challenges. For example, both external and internal auditors must effectively evaluate internal control systems, effectively make fraud risk assessments, understand their auditees’ operations and business, and focus auditing resources based on risk. In addition, both types of auditors are going to be increasingly responsible for assessing enterprise risk management (ERM) systems under the new Committee of Sponsoring Organizations of the Treadway Commission (COSO) Enterprise Risk Management–Integrated Framework. 

John Flaherty, 2004 COSO chairman, and Tony Maki, COSO Advisory Council chair, noted: “[C]ompanies may decide to look to this enterprise risk management framework both to satisfy their internal control needs and to move toward a fuller risk management process.” The COSO ERM framework explicitly recognizes that it is intended to assist organizations in achieving their objectives, including the reporting objectives that are so relevant to independent auditors.