IN THIS ISSUE
Pitfalls of the CSA Process and How to Avoid Them
THE CONTROL SELF-ASSESSMENT (CSA) audit process has been used by many organizations, some more successfully than others. Internal auditors who have tried it with good results acknowledge that being aware of best practice techniques and common pitfalls can improve their process. Keeping in mind that not every CSA facilitation encounters the same types of problems and not every issue can be anticipated, with the right planning, flexibility, and experience, problems don't have to be showstoppers. Albertsons' CSA process — known as process control assessments — starts with an understanding of the most common problems associated with a self-assessment audit, which we've dubbed PITFALL:
P: Poor planning.
The key to the success of any endeavor is adequate preparation, including anticipating problems so they can be dealt with with greater ease. CSA is not a simple process, and devoting insufficient time and resources to planning can result in problems.
Defining specific objectives is just as important. Taking on too much at the beginning of the CSA process can lead to overly aggressive goals that ends with a complicated, oversized project. It is important to meet with management to learn the business unit's overall objectives to be able to define the CSA objective.
Once the objectives are set, it is essential to select the right CSA process, such as surveys, interviews, or workshops. The facilitator has to do his or her homework to understand the operations, department structure, and level of management oversight. For example, when performing a CSA of Albertsons' promotional planning process, the auditors met with the project manager and primary stakeholders to identify the business needs of the unit, determine the objectives, and document the operational process. The group then discussed the various CSA techniques and decided which CSA process would work best for this type of assessment. The result was a one-day workshop that would include more than 20 participants.
When planning a CSA workshop, time, location, and tools are important factors to consider. Although scheduling a workshop for an accounting function during the month-end closing process is obviously a conflict, the facilitator should always obtain input from management regarding other potential or less obvious conflicts. In addition, setting the right amount of time for the workshop, as well as the entire CSA process will provide credibility in the measure of success. Experience at Albertsons has shown that if multiple functions are to be represented, it is best to schedule a longer workshop — in one case, a two-day workshop was held — to ensure the information can be compiled without requiring follow up with multiple locations and functions.
The CSA workshop location should encourage active participation and allow participants enough space to see all visual aids as well as give them sufficient elbowroom. Choosing a location where there will be minimal distractions — off-site is ideal — is also important. Setting the ground rules for use of cell phones, laptops, and other distractions can help minimize interruptions.
The participants in a CSA workshop are as important as the content. Knowing who they are and their role and interaction with each other is essential to staying focused during a workshop and when analyzing the results of questionnaires and interviews. Planning cannot be performed in a bubble. It must involve interaction with business-unit management to obtain sufficient information to set the stage. For example, in the CSA of Albertsons' promotional planning process, the agenda was sent out ahead of time so participants could come prepared. The auditors met with the project manager before the workshop to discuss the contribution of each participant selected by the project manager. A brief overview of the CSA process was provided at the beginning of the workshop, as well as the objectives, process, and expectations.
Most experienced auditors can learn facilitating skills with adequate training. However it's critical that facilitators enjoy working with people, particularly with large groups of people. If the auditor is not comfortable making presentations or managing group projects, he or she may not be the best facilitator.
The facilitator's role is to coach, moderate, motivate, and listen. In a facilitated session, the auditor may have to refrain from taking over, leading, or providing all the answers to avoid a shift in ownership of the process from the business unit to the internal auditor. He or she should provide structure to ideas and concepts, be engaging, and ensure the energy level of the workshop remains high. Facilitators should be aware of the importance of using participants' names, which is critical to capture ownership for action items and CSA follow up. Name tags are invaluable in this process.
Business unit leaders look for internal control and organizational knowledge in a facilitator, someone who can ask the right questions and guide the process documentation in a manner that will convey the importance of controls, and still allow the business-unit participants to own the process. Identifying control opportunities and ensuring they get addressed as action items can often come down to the way ideas are presented, such as: "What can your team do to make sure all advertisements are submitted timely?," rather than "Perhaps deadlines are not met because the review process is disjointed."
A facilitator needs to be able to make spontaneous decisions and react quickly without getting ruffled. Even with all the right planning, the CSA process can veer off in an unanticipated direction. The facilitator, in conjunction with the process owners, should recognize when a switch of gears is needed, which can be as simple as sensing the need for a break.
Too Many Participants
The adage "more is better" is not necessarily true when it comes to CSA participants. It is possible to conduct a CSA with a large number of people, but these sessions are generally more global in nature and relate to the entire organization rather than to a department or function. Too many participants can also prevent a CSA process from achieving the expected deliverables efficiently. To gauge the appropriate number of participants the facilitator should consider the preferred length of the workshop and number of processes being discussed. Having one person who can represent more than one process is optimal.
Having the right participant mix, including functional team members, staff, and management, will help ensure that all upstream and downstream flows — processes that indirectly or directly impact the process being reviewed — have been considered and the appropriate level of management is present. If one of the objectives is to identify immediate action items, having the appropriate level of management present to make on-the-spot decisions is important. Active participation is critical to identify opportunities within the process. A strong facilitator can help initiate participation, as well as reign in overzealous contributors.
Focus that is too narrow
To help determine the CSA objectives and identify the participants, CSA facilitators should have everyone in a department complete a questionnaire to identify the key processes. Four or five key-process experts can then identify process improvements for specific functions on which the group should focus.
Narrowing the focus of the CSA to a single process or piece of a process should be based on the business unit's objective for the CSA. When the focus is too narrow, identifying an area for improvement and making a change within the function or business unit may seem like a good idea, yet may have an unintended negative impact on someone or something up or downstream. Therefore, as a caution, ensure a narrowly focused CSA is used only for a self-contained process. For example, Albertsons' internal auditors performed one CSA in which six participants identified improvements to a specific process within the supply chain function. The participants defined the beginning and end points in the process so that the action items would not negatively impact any external functions. In another CSA — the promotional planning function — the project manager was aware of opportunities that would require buy-in from business units outside the core process. Had action items been developed for these areas without input and acceptance from these business units, they likely would not have been implemented.
Audit versus management ownership
Ownership responsibility should be assigned to those involved with overseeing that the outcome of the CSA is successfully implemented. The owner is directly impacted by the decisions being made and has a direct link in ensuring that the outcomes of the CSA will positively impact the area being reviewed.
With newer CSA processes, management may want to identify the internal audit department as the owner because they facilitate the process and follow up on implementation. The auditor should encourage management to take responsibility for effectively implementing the opportunities identified during the review. Ownership should be established at the beginning of the process, whether at the business-unit level or with senior management.
Lack of Flexibility
No two CSAs are the same. Some are textbook examples, from questionnaire to workshop, to reporting and follow-up. Others may require only a questionnaire or just a couple of interviews. The key is to keep the CSA model flexible to mold to the business-client needs. Flexibility also entails having a back-up plan for anticipated pitfalls that may jeopardize a CSA's success. For example, if a key participant cannot attend a planned workshop at the last minute, using a pre-defined alternate should be considered, rather than deferring the workshop until a future date. Flexibility is also required of the business unit or process owner as to their expectations and end results.
It is also important that the internal audit team debrief completely after every CSA to identify the successes, as well as opportunities for improvement. For a less than successful CSA, the facilitator should follow up with the process owner to identify the weak factors — wrong mix of participants, lack of a specific objective, an ineffective facilitator, inappropriate timing or location — and to plan an alternative direction. This process will also help plan future CSA's.
Limited Management Support
The most successful CSA is one in which management understands the process and the benefits to be derived, and holds employees accountable for its successful implementation. To do this management must empower those employees involved with the ability to make decisions.
The internal audit team at Albertsons has gained momentum in obtaining management support as more CSAs have been performed. In other organizations, it may initially take several presentations to management to fully explain the CSA process and how the process can benefit a business unit. By providing examples of CSA benefits and a high-level walk-through of the process, management will have the information necessary to make an informed judgment for buy in. In addition, once several successful CSAs are performed, former participants can be used to promote the effectiveness of the process.
Having used CSA within Albertsons for more than five years, CSA reviews have been completed in functions including advertising, store operations, warehouse operations, property accounting, merchandising, and import operations. The process is fine tuned every time it is used, and past experiences have reduced time needed to plan and wrap-up the CSA by more than half. There are still pitfalls now and again, but Albertsons' internal auditors have learned how to handle them more efficiently and with less stress.
Even if an organization's CSA model is highly successful, it is helpful to know that there are many self-assessment models to learn from to add to its success. Using others best practices and experiences, as well as learning from the others mistakes, are all part of the learning curve and key to future success.
Cindy D. Douglass, CCSA, is a director of internal audit for Albertsons Inc., and is located in Scottsdale, Ariz. She has more than 15 years internal audit experience in the retail and financial services industries. Douglass is a member the Phoenix chapter of The Institute of Internal Auditors (IIA) where she has held the positions of treasurer and secretary.
Joel G. Hammer is a director of internal audit for Albertsons Inc., in Boise, Idaho, and has more than 10 years experience in internal audit and public accounting. Hammer is a member of the Boise chapter of The IIA and is currently on the board of governors.
The Institute of Internal Auditors - 247 Maitland Avenue • Altamonte Springs, Florida 32701-4201 U.S.A.
+1-407-937-1100 • Fax +1-407-937-1101 • www.theiia.org
All contents of this Web site, except where expressly stated, are the copyrighted property of The Institute of Internal Auditors Inc.