CSA is an audit technique within the
broad framework of internal audit that measures areas
that traditional audit techniques are not designed to
measure, such as trust, morale and corporate culture.
There are three primary approaches to CSA: facilitated
team meetings (also known as workshops), questionnaires
(also known as surveys), and management-produced analysis.
We have adopted the workshop approach to conducting CSA.
The Institute of Internal Auditors (IIA)
developed a professional certification, the Certification
in Control Self-Assessment (CCSA), for CSA practitioners.
The first CCSA certifications were awarded in August 1999.
All CCSA’s must adhere to the IIA’s Code of
Ethics and Standards of Conduct. Currently, there are three
CCSAs working for the County of Orange Internal Audit Department.
The County of Orange is employing
a CSA process developed by PDK Control Consulting International
Limited (PDK). PDK is the seminal pioneer of CSA. We
have incorporated elements in our CSA process from them
that include conducting workshops with employees; posing
structured statements; facilitating discussions; and
compiling and reporting results. Our process uses electronic
voting devices that promote participant anonymity. We
also combine employees and management in the workshops
and employ a series of pre-workshop steps.
The CSA process works by having a representative group
of employees and management together in a workshop with
trained CSA facilitators. The facilitators present guidelines
and principles relating to the workshop and then begin
the structured part of the data gathering. The workshop
assesses critical elements that impact the workgroup’s
ability to achieve its business goals; such as employee
satisfaction, empowerment, communication, teamwork and
internal control and risk awareness. Additionally, how
well their vision, mission, and goals are communicated,
resource availability, work processes, leadership, cooperation
with related parties, departmental support, continuous
improvement, training, skill levels, and numerous other
elements.
A CSA workshop is a process in which
employee teams get together with management and specialist
facilitators to discuss, within a structured control framework,
the strengths and concerns that impact their ability to
achieve their business objectives. This same team along
with others from their organization then develop action
plans that address issues identified during the CSA workshop.
CSA workshops start at 8:15 a.m. and end at approximately
4:00 p.m. We conduct the workshops at an off-site location,
such as a regional park. Collectively with management,
we invite the participation of 8 to 15 staff members and
management who represent a good cross section of the unit.
The workshops consist of the following segments: an introduction,
situation appraisal, control appraisal, next steps, and
an evaluation of the workshop.
Introduction:
The introduction segment consists of a brief description
of what the workshop will entail and an explanation of
the workshop principles. One workshop principle requires
individual anonymity to be maintained. This means participants
agree to not discuss with others “who said what” during
the workshop. We ensure all participants agree with the
workshop principles before we begin the workshop.
Situation Appraisal:
The situation appraisal segment engages the participants
in identifying strengths and concerns that impact their
ability to achieve their business objectives. Each participant
is asked to identify and write three concerns on three
separate Post-It notes. The facilitators collect and sort
these concerns into common categories or themes while getting
the group’s consensus on the sorting. The process
is repeated in identifying strengths. Using electronic
voting devices, the group then votes to select the most
significant category of concerns and strengths for further
discussion. The facilitators again engage the participants
in identifying concerns, examples, potential impacts, and
action steps to address or capitalize on issues related
to those specific categories of concerns and strengths.
Control Appraisal:
In 1992, the Committee of Sponsoring Organizations (COSO)
of the Treadway Commission published the nationally recognized
work document for internal audit – "Internal
Control – Integrated Framework.” This publication
describes how internal controls enable an organization
to stay on course and accomplish its mission. The COSO
control framework also prescribes an integrated framework
for the internal controls and identifies the internal auditor’s
role in evaluating and contributing to the ongoing effectiveness
of the internal controls. The COSO control framework recognizes
that internal controls promote efficiency, reduce risk
of asset loss, and help ensure the reliability of financial
statements and compliance with laws and regulations. The
five elements of the control framework are:
Control Environment;
Risk Assessment;
Control Activities;
Monitoring; and
Information & Communication.
The control appraisal segment provides a structured series of 53 statements
relating to the elements of the COSO control framework. Participants
rate their agreement or disagreement with the control statements as
to how the statement corresponds to their work environment. For example,
one statement reads, "Bad news can be discussed as easily as good
news with all members of our team." The teams are asked to vote,
using wireless keypads, on whether they agree or disagree with that
statement. The voting is on a scale of 1 through 7, with 1 corresponding
to “disagree strongly” and 7 corresponding to “agree
strongly”. The team is instantly shown the results of their voting.
After viewing the results of their voting, comments are shared and recorded
relating to strengths, concerns, and possible actions to be taken to
address the issues raised in the statements.
Next Steps: For the facilitators – The facilitators will prepare a workshop
summary and distribute it to the participants in about one week after
the workshop. We limit the distribution of the workshop summary to
the workshop participants. However, we encourage the participants to
share the summary with their co-workers and higher levels of management.
We also explain the final reporting process. We prepare a final report
for public distribution that describes the department under review,
how many workshops were conducted, voting results from the workshop
evaluations, and whether or not the sections under review submitted
action plans (see below under “For the participants”).
For the participants – The manager attending the workshop has
the responsibility to prepare a written action plan after the workshop
and is strongly encouraged to include the workshop participants in
the process. The manager will review the concerns that were raised
in the workshop, which are reflected in both the workshop comments
and the workshop voting results. The manager then will develop a written
action plan to address the more significant issues. The manager has
thirty days to submit an action plan to his Department Head. Also,
we require that the Internal Audit Department be copied on the action
plan.
Participant’s Evaluation of the Workshop:
At the end of each workshop, we conduct a real time evaluation of the
session. The participants vote on statements concerning their understanding
of the purpose of CSA; whether the workshop highlighted issues significant
to the team; whether they felt they could express their opinions freely,
whether the facilitators were effective; and whether they would recommend
the process to other teams. Participants are also given an evaluation
form in which they can make specific comments regarding the workshop.
We have been conducting CSA workshops
regularly since February 1998. As of March 31, 2003,
we have completed 67 workshops with the participation
of over 800 County employees.
From Staff:
“It is nice to see that other
people shared my opinions.”
“I liked it because we could express freely and
it’s confidential.”
“It was a good chance to tell my side without directly
speaking to my supervisor”.
“No doubt it was an interesting program. Many issues
were surfaced. I learned more about the section here
than at work.”
“The Post-it Note method was positive because I
was able to express concerns that I might not have said
out loud.”
“I liked that nobody else knew how I voted but
I was able to speak if I wanted to.”
“I liked being able to see instant voting results.”
“I felt that this was a good learning process on
how other places think and the same problems are everywhere.”
“I liked to have the opportunity of viewing my
co-workers ideas of what they felt were strengths and
concerns.”
“The anonymous voting was great.”
“I got to talk about things that were in fact bothering
me. Overall, I think this was a great workshop.”
“I recommend this workshop be given to all departments
in the County.”
From Management:
“The report does an excellent job of capturing the
essence of the process, it is difficult to fully quantify
the impact the process had on our office … it has
been of immense value to me in developing an overall vision
and operating plan.”
“The process was extremely helpful in itself…as
a result of CSA, we will be able to address a number of
issues and produce a better organization providing better
service to the public.”
“We feel the workshops were very beneficial and look
forward to future opportunities to interface with your
department.”
“I sincerely believe others would also benefit from
your control self-assessment sessions, and I would highly
recommend them.”
A. No,
the CSA workshop is an audit technique within the broad
framework of internal audit, but it uses very different
tools to achieve its objectives. CSA measures areas that
traditional audit techniques are not designed to measure,
such as trust, morale and corporate culture. The data we
gather in the workshops includes consensus of comments,
opinions, and perspectives of the workshop teams. Consequently,
the information collected and reported is not audited or
validated in the traditional audit sense. The following
lists some ways CSA differs from traditional financial
audits:
CSA is a way to assess the informal or “soft” controls
in an organization which are important but are typically ignored in
traditional financial audits.
The CSA process produces greater buy-in of the results due to the
participative and collaborative approach taken in the workshops.
Workshop participants, rather than auditors, develop recommendations
to address their unique areas of concern.
The workshop participants are the content experts. The internal
auditor’s role in CSA is that of a facilitator.
Q. Why are you doing CSA in our
department/section?
A. We
conduct CSA workshops in all County Departments and Agencies.
Before we schedule the workshops, we meet with the Department
Head and decide which sections/divisions would benefit
most from CSA.
Q. Why are you doing CSA in our
department/section?
A. The
manager of the area and the Internal Audit facilitators
jointly select the workshop participants. We want to obtain
a mix of participants with various job titles from all
different levels of the organization and with various work
experience.
Q. Will what I say in the workshop
be kept confidential?
A. We
inform the participants at the beginning of each workshop
of the “workshop principles”. One workshop
principle requires individual anonymity to be maintained.
This means participants agree to not discuss with others "who
said what" during the workshop. We ensure all participants
agree with the workshop principles before we begin the
workshop. Also, the workshop summary distributed after
the workshop does not include participant names; it only
identifies the department and section attending the workshop.
Q. Have workshop participants found
the workshops beneficial?
A. We
have received strong positive feedback from participants
indicating the workshops were beneficial (refer to the “Participant
Feedback” section above). Also, during the workshops,
participants have agreed that the workshops highlighted
significant team issues and have also agreed that they
would recommend the process to other teams.
Call us 24 hours a day, 7 days a week at 714.834.3608. Anonymous claims by phone or online are okay. IMPORTANT: Employees reporting fraud are protected under the Whistleblower Law - California Labor Code 1102-5.
Legal