The Hindu Business Line : Control self-assessment: For a healthy organisation

A health-check of your organisation, the weighing scale is the CSA tool; a monthly self-check is disciplined application of the tool; the tipping scale, the red flag communication mechanism, and the weight-loss programme the ameliorative action.

IN CONTROL... The more robust an organisation's self-assessment programme, better would be the compliance framework and maturity of the business processes. — Bhagya Prakash K.

Remember the last time you put on two stones over the Yuletide? And those trousers were two inches too short? Then you got a weighing scale and a measuring tape. You used it once a month. You worked out and dieted when the scale started tipping precariously to the right. You have stayed in good shape ever since.

Quite simply put, Control Self-Assessment (CSA) is something like this applied to your organisation. It helps you carry out a health-check of your organisation. The weighing scale is the CSA tool; a monthly self-check is a periodic but disciplined application of the tool; the tipping scale, the red flag communication mechanism; and your weight loss programme, the ameliorative action.

While the concept of CSA is not a novelty, we see it mushrooming across a spectrum of verticals in recent times due to the single biggest advantage: Cost. The more robust your organisation's self-assessment programme and monitoring capabilities, better would be the compliance framework and maturity of the business processes. This results in twin synergies on the assurance activity. There is greater reliance placed by external auditors in your controls while the need for independent testing reduces eventually, bringing down the cost of controls.

Top goals

A Sarbanes Oxley 2006 survey conducted by Institute of Internal Auditors of the US identified top three organisational goals as reduction in internal costs, reduction in external auditor fees and reduction in external consultant fees. Juxtaposed with this, increasing management's involvement in the overall SOX effort and increasing reliance on self-assessment from external auditors remained other top goals.

CSA is a methodology applied at the entity and process levels of an organisation, where process owners self-evaluate the controls for which they are responsible and communicate the results to the management. CSAs are extremely scalable and can be embraced widely across the organisation to self-evaluate most things. For instance, you can assess the independence of your board of directors, efficiency of your internal audit function or measure your payments cycle time.

CSA ushers in process owner involvement by including process owners in active monitoring of risks, facilitating a critical self review and audit of controls by those individuals closest to the process and reinforcing process owner accountability.

Some other pay offs from CSAs are driving `tone at the top' and setting expectations about policies and procedures, ensuring knee-jerk reaction time to changing control environments and integrating control and risk assessment activities into daily business practices.

Operationalising CSA

So what does one do to operationalise a CSA methodology? Here are a few critical success factors to get you started:

The right guy for the right job: Identify the right process owner based on present-day roles and responsibilities and not based on hearsay or past duties. This is a common pitfall, more so in today's business processes where process and technology is closely meshed. Identify the wrong guy and you will get into a 'pass the buck game'.

Set KPIs and make him accountable: Once the right process owner is identified, make him accountable for the key controls surrounding his business process. Set KPIs for everybody involved. The plumber cannot have more than twenty waterworks leakages in a month, the procurement in charge cannot have a standard error rate greater than 0.25% and the GL head needs to close books by 5th of the next month.

Rigorous deployment throughout the organisation: A rigorous self-assessment process provides a powerful fact base, which enables certifying officers to sustain high confidence in the ongoing operating effectiveness of critical internal controls. Although the self-assessment process may be deployed in many ways, larger companies are using web-enabled assessment tools to implement it. Some of these tools include e-mail notification during different phases of the assessment process (e.g., scoring, management review, signoff, etc.) targeted at specific individuals.

Use a good weighing scale: The CSA tool is your weighing scale. Use the wrong scale and you will have a problem. Design a robust CSA to reflect real business scenarios, be unambiguous so that the process owners are not able to twist questions to their benefit and of course address things that matter most to the management. Management must also clearly define the extent to which process owners are required to support their assessments. The internal audit activity is often the source for expertise regarding CSA and for skilled facilitators.

Count your red flags: Track deficiencies, timely follow-up when issues arise, including resolution of exceptions and open matters once potentially significant deficiencies are identified.

Communication of results to management: Timely communication is the red flag communication mechanism to draw attention to potential control time bombs. CSA results need to be communicated and escalated at the right time and right forums. These results provide evidence, direct from responsible personnel that the key controls are in place and are operating effectively. Results may be communicated through simple aggregation techniques used when compiling surveys. More sophisticated techniques such as "dashboard reporting" visually indicate aggregated assessment information (status, due date, action plan and test plans, for example) and provide for "drill downs" to the appropriate level.

Bricks or bouquets: While you will take to task process owners who provide low controls assurance, also take time to reward the process owners who will give you a high controls assurance. This will keep your people motivated and not ebb the participation in the CSA exercise.

Calibrate your weighing scale: The effectiveness of self-assessment is evaluated in terms of the quality and reliability of the assurances the process provides to certifying officers. Therefore, internal audit should test selected controls to evaluate the quality of the assertions reported through the self-assessment programme. In such instances, internal audit's testing work product should be documented "outside" of the self-assessment programmers by process owners.

A panacea?

Some global corporations which have made CSAs an integral part of their controls assurance framework include France Telecom, Daimler Chrysler, Qantas and Manulife Financial.

So is CSA a panacea? All said and done it's a tool. You have to use the scale to weigh yourself, and work out and diet when you put on! So go ahead and try CSA. Make a Corporate Governance assessment scorecard for your organisation. Or just for the simpler things in life like a `time spent at home versus time spent at work' tracker for your better half. Or a `shopping budget monitor' for her. Good luck for your first CSA pilot.

(The authors are Head and Assistant Manager, respectively, Risk Advisory Services, KPMG India.)