September 24, 2008

Q&A With Dave Harmon

"I'm looking for new ideas on how to assess my organization. What is a CSA opportunity that is not commonly considered?"


One control self-assessment (CSA) approach would be a program directed toward management effectiveness. Many assessment activities are predicated on the assumption that management is basically good and that processes, resources, or staff are the things that require attention. While to a limited degree, management effectiveness is considered as part of the control environment assessment in most CSA applications, it is not the central focus of the CSA. But most feedback is too general to take the necessary specific action unless there is a major systematic issue.

A rigorous self-assessment program dealing with management effectiveness would have several benefits. First, it would enhance the control environment by clearly establishing standards, as well as a measurement process for management effectiveness, both in terms of the process itself and the perception. Second, management setting an example would send a clear message to staff members that the organization is serious about control improvement.


  1. Planning. The program would require planning, and like all CSA initiatives, sponsorship at the highest levels — executive as well as human resources — of the organization.
  2. Agreement. All involved parties need to agree upon what constitutes good management and the development of appropriate survey instruments that could be used to collect data. A starting point for this discussion might be The Committee of Sponsoring Organizations of the Treadway Commission's Enterprise Risk Management – Integrated Framework, which could provide some guidance. Also, human resources would be a good resource for developing the more detailed portion of the assessment.
  3. Rollout and assessment. This type of program would require adequate advance explanation. It would likely create a lot of anxiety and, for most organizations, it would represent the beginning of a real change in culture. To really be useful, the assessment would need to be mandatory for all management and gather input from subordinates, as well as peers and superiors. This sometimes is referred to as 360-degree feedback.
  4. Evaluate the results. The assessed manager — and perhaps his or her supervisor —would receive the results and human resources would assist the manager in interpreting the results, suggesting courses of action where appropriate.
  5. Follow-through on assessment results. Follow-through can be done either by individual managers, superiors, or human resources.


The first year would be the most difficult, but at the same time, it would present the greatest opportunity for building credibility. If this is an absolutely new process, you can be assured that while there will be room for improvement across the board, a few glaring management problems may require immediate attention. The important thing is to have appropriate measured response. Individual managers and their supervisors are well equipped to deal with most issues reported (e.g., communications, performance evaluations, perceived equity issues, transparency of processes). However, if there is clear dysfunction in the group, it may require human resources to become directly involved. As with other CSA results, if a significant issue is reported, some action — whether it be training, reassignment, or termination — must result.

I have personally seen such a program implemented and it made a huge difference. Although the system won't guarantee that every manager is perfect, it does have the capability to improve overall management. In the program I saw implemented, there was flexibility for dealing with good performers that were not management material and a few underperformers were removed altogether. Some may view this as a stretch for CSA, but I honestly disagree. Management is as key a control as any other, and it makes perfect sense to have CSA assess it.

Have a question about CSA you'd like to ask Dave? E-mail your question to the editor. It could be answered in a future issue of CSA Sentinel.

David Harmon, CIA, CCSA, CPA, CISA, is director of financial management programs at the University of California, Los Angeles, and instructs several IIA courses on CSA. Harmon helped to develop a CSA program in his former position at Fannie Mae and contributed to the questions in The IIA's Certification in Control Self-assessment exam.

All contents of this Web site, except where expressly stated, are the copyrighted property of the Institute of Internal Auditors Inc.