Control Self-Assessment (CSA)

What is Control Self-Assessment (CSA)?

CSA is an audit technique within the broad framework of internal audit that measures areas that traditional audit techniques are not designed to measure, such as trust, morale and corporate culture. There are three primary approaches to CSA: facilitated team meetings (also known as workshops), questionnaires (also known as surveys), and management-produced analysis. We have adopted the workshop approach to conducting CSA.

Professional Certification for CSA

The Institute of Internal Auditors (IIA) developed a professional certification, the Certification in Control Self-Assessment (CCSA), for CSA practitioners. The first CCSA certifications were awarded in August 1999. All CCSA’s must adhere to the IIA’s Code of Ethics and Standards of Conduct. Currently, there are three CCSAs working for the County of Orange Internal Audit Department.

What is the CSA Process?

The County of Orange is employing a CSA process developed by PDK Control Consulting International Limited (PDK). PDK is the seminal pioneer of CSA. We have incorporated elements in our CSA process from them that include conducting workshops with employees; posing structured statements; facilitating discussions; and compiling and reporting results. Our process uses electronic voting devices that promote participant anonymity. We also combine employees and management in the workshops and employ a series of pre-workshop steps.

The CSA process works by having a representative group of employees and management together in a workshop with trained CSA facilitators. The facilitators present guidelines and principles relating to the workshop and then begin the structured part of the data gathering. The workshop assesses critical elements that impact the workgroup’s ability to achieve its business goals; such as employee satisfaction, empowerment, communication, teamwork and internal control and risk awareness. Additionally, how well their vision, mission, and goals are communicated, resource availability, work processes, leadership, cooperation with related parties, departmental support, continuous improvement, training, skill levels, and numerous other elements.

What is a CSA Workshop?

A CSA workshop is a process in which employee teams get together with management and specialist facilitators to discuss, within a structured control framework, the strengths and concerns that impact their ability to achieve their business objectives. This same team along with others from their organization then develop action plans that address issues identified during the CSA workshop.

CSA workshops start at 8:15 a.m. and end at approximately 4:00 p.m. We conduct the workshops at an off-site location, such as a regional park. Collectively with management, we invite the participation of 8 to 15 staff members and management who represent a good cross section of the unit. The workshops consist of the following segments: an introduction, situation appraisal, control appraisal, next steps, and an evaluation of the workshop.

Introduction: The introduction segment consists of a brief description of what the workshop will entail and an explanation of the workshop principles. One workshop principle requires individual anonymity to be maintained. This means participants agree to not discuss with others "who said what" during the workshop. We ensure all participants agree with the workshop principles before we begin the workshop.

Situation Appraisal: The situation appraisal segment engages the participants in identifying strengths and concerns that impact their ability to achieve their business objectives. Each participant is asked to identify and write three concerns on three separate Post-It notes. The facilitators collect and sort these concerns into common categories or themes while getting the group’s consensus on the sorting. The process is repeated in identifying strengths. Using electronic voting devices, the group then votes to select the most significant category of concerns and strengths for further discussion. The facilitators again engage the participants in identifying concerns, examples, potential impacts, and action steps to address or capitalize on issues related to those specific categories of concerns and strengths.

Control Appraisal: In 1992, the Committee of Sponsoring Organizations (COSO) of the Treadway Commission published the nationally recognized work document for internal audit – "Internal Control – Integrated Framework." This publication describes how internal controls enable an organization to stay on course and accomplish its mission. The COSO control framework also prescribes an integrated framework for the internal controls and identifies the internal auditor’s role in evaluating and contributing to the ongoing effectiveness of the internal controls. The COSO control framework recognizes that internal controls promote efficiency, reduce risk of asset loss, and help ensure the reliability of financial statements and compliance with laws and regulations. The five elements of the control framework are:

  • Control Environment;
  • Risk Assessment;
  • Control Activities;
  • Monitoring; and
  • Information & Communication.

The control appraisal segment provides a structured series of 53 statements relating to the elements of the COSO control framework. Participants rate their agreement or disagreement with the control statements as to how the statement corresponds to their work environment. For example, one statement reads, "Bad news can be discussed as easily as good news with all members of our team." The teams are asked to vote, using wireless keypads, on whether they agree or disagree with that statement. The voting is on a scale of 1 through 7, with 1 corresponding to "disagree strongly" and 7 corresponding to "agree strongly". The team is instantly shown the results of their voting. After viewing the results of their voting, comments are shared and recorded relating to strengths, concerns, and possible actions to be taken to address the issues raised in the statements.

Next Steps

For the facilitators – The facilitators will prepare a workshop summary and distribute it to the participants in about one week after the workshop. We limit the distribution of the workshop summary to the workshop participants. However, we encourage the participants to share the summary with their co-workers and higher levels of management. We also explain the final reporting process. We prepare a final report for public distribution that describes the department under review, how many workshops were conducted, voting results from the workshop evaluations, and whether or not the sections under review submitted action plans (see below under "For the participants").

For the participants – The manager attending the workshop has the responsibility to prepare a written action plan after the workshop and is strongly encouraged to include the workshop participants in the process. The manager will review the concerns that were raised in the workshop, which are reflected in both the workshop comments and the workshop voting results. The manager then will develop a written action plan to address the more significant issues. The manager has thirty days to submit an action plan to his Department Head. Also, we require that the Internal Audit Department be copied on the action plan.

Participant’s Evaluation of the Workshop: At the end of each workshop, we conduct a real time evaluation of the session. The participants vote on statements concerning their understanding of the purpose of CSA; whether the workshop highlighted issues significant to the team; whether they felt they could express their opinions freely, whether the facilitators were effective; and whether they would recommend the process to other teams. Participants are also given an evaluation form in which they can make specific comments regarding the workshop.

Number of CSA Workshops Conducted

We have been conducting CSA workshops regularly since February 1998. As of March 31, 2003, we have completed 67 workshops with the participation of over 800 County employees.

A Sample of Participant Feedback Comments

From Staff:

  • "It is nice to see that other people shared my opinions."
  • "I liked it because we could express freely and it’s confidential."
  • "It was a good chance to tell my side without directly speaking to my supervisor".
  • "No doubt it was an interesting program. Many issues were surfaced. I learned more about the section here than at work."
  • "The Post-it Note method was positive because I was able to express concerns that I might not have said out loud."
  • "I liked that nobody else knew how I voted but I was able to speak if I wanted to."
  • "I liked being able to see instant voting results."
  • "I felt that this was a good learning process on how other places think and the same problems are everywhere."
  • "I liked to have the opportunity of viewing my co-workers ideas of what they felt were strengths and concerns."
  • "The anonymous voting was great."
  • "I got to talk about things that were in fact bothering me. Overall, I think this was a great workshop."
  • "I recommend this workshop be given to all departments in the County."

From Management:

  • "The report does an excellent job of capturing the essence of the process, it is difficult to fully quantify the impact the process had on our office … it has been of immense value to me in developing an overall vision and operating plan."
  • "The process was extremely helpful in itself…as a result of CSA, we will be able to address a number of issues and produce a better organization providing better service to the public."
  • "We feel the workshops were very beneficial and look forward to future opportunities to interface with your department."
  • "I sincerely believe others would also benefit from your control self-assessment sessions, and I would highly recommend them."


Is the CSA Workshop an Audit?
No, the CSA workshop is an audit technique within the broad framework of internal audit, but it uses very different tools to achieve its objectives. CSA measures areas that traditional audit techniques are not designed to measure, such as trust, morale and corporate culture. The data we gather in the workshops includes consensus of comments, opinions, and perspectives of the workshop teams. Consequently, the information collected and reported is not audited or validated in the traditional audit sense. The following lists some ways CSA differs from traditional financial audits:
  • CSA is a way to assess the informal or "soft" controls in an organization which are important but are typically ignored in traditional financial audits.
  • The CSA process produces greater buy-in of the results due to the participative and collaborative approach taken in the workshops.
  • Workshop participants, rather than auditors, develop recommendations to address their unique areas of concern.
  • The workshop participants are the content experts. The internal auditor’s role in CSA is that of a facilitator.
Why are you doing CSA in our department / section?
We conduct CSA workshops in all County Departments and Agencies. Before we schedule the workshops, we meet with the Department Head and decide which sections/divisions would benefit most from CSA.
REPLACE***Why are you doing CSA in our department / section?
The manager of the area and the Internal Audit facilitators jointly select the workshop participants. We want to obtain a mix of participants with various job titles from all different levels of the organization and with various work experience.
Will what I say in the workshop be kept confidential?
We inform the participants at the beginning of each workshop of the "workshop principles". One workshop principle requires individual anonymity to be maintained. This means participants agree to not discuss with others "who said what" during the workshop. We ensure all participants agree with the workshop principles before we begin the workshop. Also, the workshop summary distributed after the workshop does not include participant names; it only identifies the department and section attending the workshop.
Have workshop participants found the workshops beneficial?
We have received strong positive feedback from participants indicating the workshops were beneficial (refer to the "Participant Feedback" section above). Also, during the workshops, participants have agreed that the workshops highlighted significant team issues and have also agreed that they would recommend the process to other teams.
Show all Categories