CSA Sentinel - The Institute Of Internal Auditors  


Second Quarter 2007 • Vol. 11 • No. 2
printPrint Article
printPrint Entire Issue

Quick Tips: Four Tips to Help Develop a Successful and Sustainable CSA Program

Following these tips can help internal auditors plan and prepare for a successful CSA program.


The Committee of Sponsoring Organizations of the Treadway Commission's (COSO's) Internal Control — Integrated Framework is the foundation for all other components of the internal control framework and includes factors such as culture, integrity, ethical values, and management philosophy. Because each organization is unique, it is imperative to carefully consider the ethical and cultural environment of the organization when determining which control self-assessment (CSA) process to implement to achieve positive and lasting results. Additionally, auditors and CSA practitioners need to make sure they have a clear understanding of the objectives identified by operational management, audit and compliance, and all employees. Value must be derived from these three groups to help develop a successful and sustainable CSA program. Whether an organization identifies risk through internal control questionnaires or facilitated workshops, using these simple tips — combined with understanding the organization's objectives — will help create a successful CSA program.


Planning is essential for a successful CSA. Prior to implementing anything, do your homework to determine the right CSA approach for the organization. CSA can be an excellent tool for identifying and reducing organizational risks, but because questionnaires and workshops are beneficial in different ways, networking with other audit professionals can help auditors determine the best approach to implement in a particular organization.

Internal Control Questionnaires
The advantage of using internal control questionnaires is the ability to reach a broader audience in less time. A questionnaire could reach each employee in an organization at every location with little effort. However, each questionnaire is only as good as the questions being asked and this process does not allow respondents to add detailed information pertinent to the topic. When planning to use questionnaires, keep these things in mind:

  • Questionnaires should be carefully and thoughtfully worded to allow employees from all levels and backgrounds to understand what is being asked.
  • Keep internal control questionnaires short to maximize participation. A maximum of 20 to 25 questions is best.
  • For better results, avoid sending surveys too close together. Internal auditing may not be the only department within the organization to rely on surveys for information, and there could be some confusion and burn-out experienced by employees.
  • Use a rating scale appropriate for the topic and use an even number of options to prevent participants from consistently voting in the middle of the range (e.g., consider 1– 4, 1– 6). This helps make sure the survey questions are understood and provides better results when analyzing responses.

Facilitated Workshops
Facilitated workshops are advantageous because participants buy into the process and identify their own risks. The process of analyzing and prioritizing these risks lies with the people affected by the risks. In addition, conversation between participants in a workshop can be expanded upon and action steps to reduce risks can be discussed. However, facilitated workshops are time- and labor-intensive, so it would take considerable time to complete workshops in every department of most organizations. When planning workshops, remember that:

  • Employees must achieve results rather than feeling like another process is being imposed by management.
  • Employees from all levels of an organization should participate. The people who perform the day-to-day work may be aware of risks but lack a venue to bring them to the attention of management. Ideas for improving risks can be discussed collectively by all participants and management.

Regardless of which approach is used, an important — and often overlooked — element of the planning phase is explaining the CSA process to management and establishing expectations regarding the benefits that can be derived from it. This will help generate support before questionnaires are distributed or workshops are held.


In a CSA process, planning and preparedness go hand in hand. CSA practitioners employ different methods to prepare for internal control questionnaires and facilitated workshops. No matter the approach, time should always be factored in to adequately prepare for the assessment. Here are some things to keep in mind during preparation:

  • Identify high-level risks and include them in the survey.
  • Know the audience and gear the material to employees in the appropriate job classifications.
  • Allow enough time for responses (e.g., three weeks as opposed to one week).
  • Send reminder notices to increase participation.
  • Do not issue surveys close to major holidays because mployees may be rushed to complete their work before a vacation or will be buried under work when they return to the office.
  • Do not overlap surveys; response rates could significantly drop due to confusion.
  • Establish ground rules for workshops and make certain participants understand and agree to abide by them.
  • For workshops, ensure logistics are conducive for group participation and consider the best location, table and chair configuration, seating preferences, equipment, and room temperature.


After the questionnaires have been returned and evaluated or after a workshop has ended, many CSA practitioners forget or take too long to share the results with participants. After the CSA process is complete:

  • Schedule time to communicate and deliver the results of internal control surveys or facilitated workshops as soon as the results are available.
  • Follow up in a timely manner with management to assess whether appropriate action has been taken to address risks.
  • Add an educational component to internal control questionnaires and workshop results by providing employees with corporate policies or other references at the conclusion because the information may be new to some employees.


CSA is not just a tool to help organizations achieve their objectives. It provides an avenue for auditors and practitioners to hone their process and become even more experienced. By keeping the following final things in mind, practitioners will be able to create a successful CSA program:

  • Never stop improving your CSA process; one size does not necessarily fit all. An organization may get more benefit from a combination of internal control questionnaires and facilitated workshops.
  • Continue to earn the trust of the customers; everyone is employed by the same organization.
  • Avoid the temptation to perform an internal audit too close to a facilitated workshop, as this could impact future participation levels.
  • Monitor your own progress.
  • After a period of time, distribute an internal control questionnaire again or facilitate another workshop to ascertain whether risks previously identified are addressed and new risks are recognized.
  • Continue to add value to your organization and customers by educating them on policies and procedures and being available for questions.
Judi Locketz, CCSA, is the director of internal controls and accountability at the University of California, San Francisco (UCSF). Judi developed and teaches an ethical awareness course at UCSF, is a California certified mediator, and is a volunteer instructor for The IIA. Prior to joining UCSF, Judi spent 11 years working in the internal audit field for various industries.
Rate this article!
Extremely relevant    6    5    4    3    2    1    Not relevant
Extremely useful    6    5    4    3    2    1    Not useful
Quick Poll

How has flextime work schedules impacted audit completion time for your agency?

Audits have been completed faster.

There has been no change.

Audits take longer to complete.

My agency does not have a flextime poilcy.

View Results