IN THIS ISSUE

CSA Questionnaires Work;
Web Enabled, They Amaze

By ADRIAN D. BARRY, former internal audit director of XYZ Co.

TODAY’S INTERNAL AUDITORS have myriad software tools at their disposal to help the audit function be more effective. Ideally, they should use technology to enhance the way the audit function interacts with the rest of the company. At XYZ Co., a Silicon Valley computer software and hardware company, we found that this worked best by equipping the internal audit department with a Web-survey process, specifically, a survey-based control self-assessment (CSA) tool.

THE CHALLENGE

In 1999, as part of the internal audit department’s goals, XYZ’s chief financial officer (CFO) asked us to:

• Stay within a reduced budget (down 20 percent from the previous year). 
• Keep the headcount low (not fill the positions that had been vacated). 
• Travel less and eliminate nonstop business-class flights. 
• Maintain the same level of audits to assure the CFO and the audit committee, in real time, that global internal controls are strong and working effectively and efficiently.  
• Continuously assess the risk environment. 
• Develop a program or process to educate the finance and business communities on current internal policy and external financial regulations.

This was our challenge. In addition to the CFO’s list, there was one more internal audit issue that we thought needed addressing — communication. It is through solid communication that internal auditing mitigates company risk. We recognized the need to develop ways to communicate companywide, on a regular basis, through a medium that could be managed as the company changed in size and complexity.

We knew that CSA would be the best approach. However, the best-known CSA function is workshop-based, where participants take part in a three- or four-hour session, discussing a topic and voting anonymously. Our participants were located around the world, making this approach difficult.

CSA questionnaires, on the other hand, can be completed individually using Excel-based forms, which internal auditing reviews. The initial setup for the questionnaire approach may take some time, but once up and running, it is easy to sustain because it essentially leads to a continuous-assessment process whereby the company’s employees become more control conscious, continually critiquing the effectiveness and efficiency of the process and the processes under review. Issues identified through the risk-assessment process can be addressed through the questionnaires, and the questions can then circle back and feed into the risk-assessment process.

In addition, questionnaires help determine the strength of the control environment, reinforce business and financial policies, and minimize internal audit resources while extending the global reach. Internal auditors can act as technical support by reviewing assessment results regularly and reporting the information back to management — the owners of the process — who can choose to make changes based on their priorities. 

By using questionnaires, internal auditors partner with the client and transfer knowledge to the locations. Essentially, they get a finger on the pulse of the organization, and can be alerted to any changes in the strength of the control environment on a timely basis.

The downside of using paper-based questionnaires is that the data is difficult to manage, store, and manipulate. At XYZ, the data was not submitted in softcopy format. When we wrote our reports, we used a combination of Word and Excel documents, which proved to be labor intensive to draft and summarize. Web-enabled CSA programs, on the other hand, free up large amounts of administrative time.

GETTING STARTED

Picking the right organization to pilot the process was key to increasing the likelihood of success. CSA’s may not be suitable for all organizations — in terms of people, processes and procedures. After reviewing the way the company is organized, we selected the Field Sales Organization to pilot the program. Field Sales comprises 30 sales offices around the world, and has simple business processes at each site that can be tested each quarter. 

We needed a way to connect all of the participants from each of the 30 offices, so we opted to use a Web-enabled questionnaire. A powerful Web-based survey facilitates constant communication between internal auditing and all functions and geographies. We hired a feedback management expert that had numerous Web-enabled applications in its product range. The firm developed an application suite that allows internal audit groups to implement self-reviews of business processes and controls regularly. It also facilitates the implementation of a comprehensive questionnaire-based CSA program and archives the data. Powerful report generators enable the auditors to spot trends in processes companywide by function and geography. 

In addition, the application suite provides a framework of continuous feedback to management on the progress made in achieving action items and eases planning efforts by permitting questionnaires to be designed quickly and sent to clients prior to fieldwork. Moreover, the Web-based questionnaire allows links to be built around the tool, enabling visitors to the site to enhance their knowledge of business and financial policies and financial regulation developments.

The cost of hiring our feedback managers equated to that of a senior staff member’s salary for one year. The fee consisted of paying the Web consultants for hosting the survey (compiling and archiving data on their servers), providing technical support, and visiting three countries each quarter for two weeks to validate that the documents self-tested by the sales office were real. The time taken to design and implement the Web-based solution was reduced significantly. 

ROLES AND RESPONSIBILITIES 

For a Web-enabled questionnaire program to succeed, all parties must have clearly defined roles and responsibilities. At XYZ, our CFO sponsored the program. Regional controllers were part of the participating team. Country controllers oversaw the testing performed by their staff and contributed to testing themselves, and finance/operations staff performed more detailed testing.

Because executive management sets the tone, they should be cheerleading. Each quarter when the results are communicated, a message reminding everyone involved of the importance of the process should come from the sponsor, the CFO. Middle management should listen to the audit teams, who report the results, and should prioritize the resolution of issues identified by their participating teams.

THE PROCESS

Our internal auditors rolled out the process by visiting different regions — in conjunction with the company’s biannual regional finance get-togethers — presenting the program, and training participants. The questionnaire took four weeks to develop, which included back-and-forth time with key participants and input from outside auditors. We used fundamental process questions that many of the large accounting firms use. Initially, some participants were reluctant to participate. Support from regional bosses and the CFO proved invaluable during this time.

Participants were e-mailed a Web-link and were provided with passwords so that they could submit self-tested transaction data via the Web privately and securely. They were asked to complete a survey describing the controls in place and plans to resolve any weaknesses. Once the program was up and running, they completed the survey annually. Quarterly, they were required to test, on a rotational basis, six key processes identified for the sales offices: 

• Sales (quote to collect) 
• Purchases (procure to pay) 
• Cash management 
• Information systems 
• Fixed assets 
• Inventory

When issues were noted in the quarterly reports, participants were required to identify action items and provide updates as to the progress being made to resolving them. Managers in both the regional and global offices were then provided with summary reports of the quarterly testing performed.

Internal auditing facilitated the process by reviewing the data that participants submitted via the Web and ensuring that it matched the original documents kept at the site. Auditors selected additional sample transactions to test — those not already self-selected by the country. Auditing also critiqued participants’ assessments and fed the results back to the regional controllers.

Within a few months, the program was running smoothly, and by the fourth or fifth quarters, participants realized that this was not just another project that was destined to fail, and they began to embrace the program.

POSITIVE RESULTS

Too often the "folks in the trenches" maintain inefficient processes, fearing that making any changes could lead to adverse audit findings. As an auditor, it is wonderful to observe the benefits of empowering the staff and to watch how lean the processes can become. 

At XYZ, we enjoyed a multitude of benefits as a result of the Web-enabled questionnaire. The process:

• Created a structure for educating finance and other functional groups on risk-assessment policies and controls. 
• Presented the opportunity to raise company policy awareness at the country level and permitted feedback to corporate as to what was happening in the field. 
• Enabled internal auditing to pay quarterly visits to the regions for validation only, significantly reducing the time, resources, and travel expenses needed for the traditional audit model. 
• Led to greater focusing of traditional internal audit efforts. If the CSA highlighted problem areas, the audit team would travel to a particular region to perform a comprehensive audit. 
• Improved auditing’s responsiveness, because auditors become aware of issues more quickly with the questionnaires. 
• Helped us identify good controls in areas such as granting credit, credit history review, discount approval, and export compliance. Once the exceptional controls were identified, they were posted on the Web site, where everyone could access them. Auditing also presented them to the local team during validation visits. 
• Assured both the external auditors and company management that approximately X percent of worldwide revenue was sampled and no significant issues were noted. 
• Reduced the amount of work external auditors performed at their year-end audit. External auditors could review the quarterly testing and the results of the annual controls survey and gain assurance about the company’s control environment. 
• Enabled process owners and auditors to detect aggressive sales behavior (by comparing ship request date to the actual shipping date), aggressive booking (by comparing purchase order date to the date the order was booked), and lack of sales contracts.

Quarterly, we ranked our regions — Americas, Europe, Asia Pacific, and Japan — based on the completeness of the answers as well as levels of participation (sometimes countries did not submit questionnaire responses). A sense of pride emerged from this, and participants were always eager to learn who would be first or last each quarter. The rankings also were considered in the country controllers’ performance evaluations.

WORTHWHILE EFFORT

Implementing a questionnaire-based CSA process is well worth the effort. Before the CSA questionnaire program was implemented at XYZ, internal auditing typically would visit each of the company’s 30 offices every three years for at least a week to perform audits. The visits were expensive and yielded questionable benefits. Audit findings were then given to the clients for them to act on, and there was very little participation by clients in the assessment of their operation. 

CSA is quite the opposite, and a questionnaire approach specifically allows for even more consistent and ongoing communication. Now, XYZ’s internal auditors partner with the clients and help transfer knowledge to the locations. Auditing also has a greater awareness of the company’s control environment, and as a result is more responsive. Internal auditing, external auditing, the audit committee, the CFO, the participants, and the company as a whole benefited from this process.