CSA Sentinel - The Institute Of Internal Auditors  


printPrint Article
printPrint Entire Issue


By Yves-Renée Michel
Regional Risk Management and Internal Control Coordinator
African Region Resource Management Group
The World Bank

After a successful six-month pilot of the Control Self-assessment (CSA) Workshop Program, the Africa Region of the World Bank Group Africa decided to launch full CSA coverage of our Washington, D.C., units and offices in Africa. The format involved a combination of techniques including "Option Finder" anonymous voting technology consistent with World Bank CSA practices. Region officers believed it essential our own staff carry out the CSA workshops to fully utilize the power of CSA while linking elements of the Committee of Sponsoring Organizations (COSO) framework to our risk management activities. This would provide a powerful way of exposing regional staff to various concepts of risk management and adequate controls. Staff would gain practical experience, as well as knowledge about how to effectively assess and manage risks, to champion the process from within the business. As a result, staff would be better able to assist management in developing improved internal control systems.

To reach these goals, several steps were taken. First, a focus for implementing the program was established under a regional risk management and internal control coordinator. Second, considerable effort was devoted to meeting line managers and staff to market the CSA concept and to discuss, on a one-on-one basis, topics such as objectives, workshop delivery approaches, likely facilitators, and how to ensure a good understanding of CSA. Based on our in-house standards, we canvassed colleagues who we thought would make good facilitators. These potential facilitators were not internal auditors but staff from the Africa Region Resource Management Group (AFTRM), and colleagues from other units who wanted to contribute to this program. During this phase, control appraisal questions, based on the five elements of the COSO framework, were developed to assess participants’ views on the adequacy of their internal control structure.

Building the CSA Facilitation Team
To build the CSA facilitation team we wanted, we developed an in-house training program. Our main goals for the training program were to ensure that facilitation team members understood the meaning of risk, control, and objective in the CSA context. In addition, we wanted to make certain our team acquired the necessary soft skills to carry out workshops in a multicultural environment with different types of client-units (in Washington or in Africa), while observing the required ethical practices. Facilitators who could speak fluent French turned out to be a critical element in the success of the pilot stage as most managers involved in the initial stages were responsible for French-speaking countries in Africa such as Madagascar, Togo, and Burkina Faso.

In the early training sessions, we partnered with representatives from the World Bank Internal Auditing Department (IAD) and the Controller's Office, the World Bank’s training arm--the World Bank Institute--as well as experts from other business offices. Our IAD colleagues played an active role in helping us build and carry out our training program. We benefited from the IAD staff’s understanding of how to apply the CSA process and COSO framework in identifying risks and adopting adequate controls to achieve set objectives. They taught us how to prepare a CSA workshop process, which included making presentations with relevant context, and using related examples to help workshop participants understand the process and COSO. The internal auditors guided us on how to prepare polling questions for various workshops, as well as how to use the available portable voting technology. They advised us on how to deliver workshops that added value to our clients’ work, how to prepare a CSA workshop report, and how to record our views on the process. We learned key practices and ways to work with the participants to develop their ownership of the workshop results. IAD staff also helped us understand our ethical responsibilities, the need for objectivity during the process, and the level of confidentiality necessary for the CSA process.

Our World Bank Institute colleagues provided us with cutting-edge facilitation sessions, shared the do’s and the don'ts, and taught us how to generate effective audience participation. These sessions included a variety of best practices, guidance on delivering a successful presentation, and being alert to team dynamics. They observed the trainees during presentations or facilitating sessions, offering guidance on areas for improvement. 

In addition, we brought in other speakers to join the training sessions. For example, the World Bank auditor-general and controller shared their visions for internal control. The World Bank manager of the Business Ethics Office presented a session in which she talked about the links among ethics, internal controls, and risk management. We also invited colleagues who participated in previous workshops to talk about their views of the CSA process from a client's perspective. 

The World Bank Controller's Office sponsored the CSA process institution-wide, which allowed us to consult and interact with those colleagues to guarantee we were using the latest institutional standards in delivering the CSA program. We also worked with colleagues from the Africa Regional Information Technology Team, who made sure the facilitators were comfortable in using the workshop equipment, such as a projector, and the voting technology, as well as providing the necessary training to use the various application packages for CSA workshops.

Making It Work
Because our facilitators have other responsibilities, we strived to minimize any undue pressure, unnecessary work, or conflicts with their regular clients. To do this, we put in place working standards and templates, reference documents, and samples of various types of reports. As the internal control and risk management team leader, I coordinated the process and kept all facilitators posted on emerging issues, changes, or engagements. Also as team leader, I handled the marketing of the CSA program, workshop planning, facilitators' training, and other related aspects.

Today, we have about 15 facilitators from within the region. We have promoted a close working relationship with our partners and clients, and have excellent teamwork among the facilitators. Sharing best practices on a regular basis assures transfer of knowledge, and teaming new facilitators with veterans ensures that they are comfortable with the various skills and responsibilities before taking the lead in workshops. To maintain acquired skills, we require each facilitator to carry out at least two workshops a year. We also plan to open the facilitation process to other technical staff within our region to promote the importance of effective risk management, and to lay the foundation of internal controls and risk management practices more widely among staff. 

Feedback from workshop participants has led to numerous changes to the process. For example, the workshops were renamed Risk Management and Control Self-assessment (CSA/COSO) workshops because the term control self-assessment alienated many clients. Early on, we had to determine how to be inclusive and have a large number of participants without compromising the workshop process. We decided to include all staff members who were part of a team or office, and had to learn to manage the process as we progressed. One concern of this large-group approach was losing participants’ interest so we used local contexts or anecdotes to illustrate the meaning of CSA and of the elements of COSO. The challenge of making our clients comfortable with CSA helped us refine our education process about risk and control, and how these relate to the achievement of organizational objectives. 

Our CSA clientele has increased since the initial pilot stage, and we have conducted 30 workshops so far. Our program is not aggressive because we want to implement it in stages to fine-tune the process as we learn more about CSA and our clients' needs. Priority was given to those units where management expressed strong interest in the CSA process. Early on, workshop participants were a bit apprehensive about the real purpose of the process. Consequently, we made it a priority to deal immediately with any doubt about the program’s objectives. We learned, too, that workshop participants must function as a team before undertaking the CSA process. The workshop format also has been modified so participants can really learn how to self-assess. This allows them to conduct their own discussions of identified risks while taking into account possible root causes, the effect of these risks on the achievement of business objectives, how well these risks can be managed what are the residual risks, as well as who can help carry out the needed remedial actions.

Collaboration is the Key
Effective guidance from our partners, in particular from the internal audit department, helped tremendously in building our CSA facilitation team. Collaboration among the various players was the real key to the program’s overall success. We have become more independent and knowledgeable about risk and controls, and the scope of our risk management and internal control activities is broadening. We are now seeking new ways to offer additional support to our clients, and to assist them by providing effective follow-up on CSA workshop action plans while they maintain ownership of the process. 

As the importance of risk management and control self-assessment is increasingly recognized, we look forward to continued collaboration with our partners, and building on our experience and practices to positively impact the World Bank Group’s work in Africa and Washington.

CSA Center Members — We Need Your Feedback!

The IIA is considering renaming the Control Self-assessment (CSA) Center, but in the spirit of self-assessment, we need your feedback. See Center News for details.

AA tile
Quick Poll

How has flextime work schedules impacted audit completion time for your agency?

Audits have been completed faster.

There has been no change.

Audits take longer to complete.

My agency does not have a flextime poilcy.

View Results