IN THIS ISSUE
|
According to Mike
Control Self-assessment: A Retrospective
MICHAEL PIDZAMECKY, CFE, CMA
CONSULTANT
TORONTO
It's been more than a decade since I was first introduced to CSA at Westcoast Energy. At that time, CSA was a process-based program where the audit group would lead departments through a self-evaluation of their risks and controls, economy, efficiency, effectiveness, and the ability to meet stated goals and objectives. One of the key components of the program — the use of storyboards to document the process — actually was pioneered by Westcoast Energy.
CSA was such a great success with the departments that volunteered to be our test subjects that when we officially offered it as an audit approach, we found many willing participants. I have conducted many types of self-assessment reviews over the years — objective, controls, and risk — and although I may be biased by saying all were successful, it was the continous, positive testaments from unbiased clients that proved self-assessment was an important tool for any audit group. I remember one company where The Committee of Sponsoring Organizations of the Treadway Commission/Criteria of Control CSA approach was fully supported by the chief executive officer. This approach was used to help the company and its personnel examine the organization and determine what was needed to transform it from a money-losing operation into an industry leader. CSA was credited as one of the key success factors responsible for transforming this organization into one of the most profitable companies in its industry.
In the beginning, many of us faced distractions and hurdles while trying to implement self-assessment. Some management and even internal audit leaders believed that internal audit should only do financial and compliance auditing; therefore, self-assessment was refused. Others gave permission to implement self-assessment for the opposite reason — they saw CSA as a way of doing more audits in less time and with fewer resources. But we discovered that CSA was only one of many audit approaches. Some of us had senior management's support, but soon discovered that other departments were working against us because they were afraid of what we would undercover. I can even remember external auditors laughing at the idea of self-assessments being conduct by internal auditors, let alone company management.
CSA professionals always will face challenges in trying to implement some sort of self-assessment program. But will the premise of self-assessment ever die? Absolutely not! It has been around for close to a century in the form of your annual tax return. And every time you travel between countries and complete a customs declaration, you self-access. Even today, we have legislation that requires management to self-assess the internal controls over financial reporting. And the latest and greatest sound business practice — enterprise risk management (ERM) — is rooted in the need to have the entire organization self-assess the potential risk it faces each year to maximize business objectives and opportunities.
Whether you are a practitioner of internal or external audit, financial reporting, risk management, regulatory compliance, or human resources, you're administering at least one self-assessment review or audit in one form or another. CSA is a fact of life and a fact of business that always will be present. So let's strive to work with one another to share experiences and processes so that we can realize the full potential of self-assessment programs.
This will be my last column for CSA Sentinel. During the last 10 years, I've seen and done a lot with CSA, or as I like to call it, just plain old self-assessment. I know many of you do not agree with all of my opinions, but I can say that I've learned a lot by listening with an open mind. To all of you out there who have read my column, thank you for at least giving me an ear — whether you agreed or disagreed. My last opinion for you is this: no matter what others say, no matter what others are doing, and no matter how much you paid the consultant — in the end, you choose the self-assessment approach that best meets the needs of your organization. Remember, in self-assessment, there is no wrong or right way — only the best way.
Finally, I would like to thank all of my editors, past and present, for all their help and encouragement. It is through their dedication and support that this rough piece of rock could be polished up and turned into diamond.
Michael Pidzamecky, CFE, CMA, is a private consultant who works with CSA and ERM processes. Pidzamecky has developed several self-assessment approaches, presented sessions for IIA courses and conferences, and written questions for the Certified Control Self-Assessment exam.
|
|
Print Article