|
Facilitate.com enables departments to conduct a Control
Self Assessment
The Challenge
Control Self-Assessment (CSA) is a
process gaining some popularity in the U.S. and already
popular in Canada. In the CSA process, a facilitator
walks a team, department or group through an evaluation
of the risks that have an impact on the achievement
of the goals and objectives of their own area, and any
mitigating controls associated with those risks. This
process provides an alternative to a traditional operational
audit that is less imposing and more efficient, while
producing a very similar end result. CSA can be incorporated
into the annual audit plan, meets the mission and operating
structure for Internal Audit, and meets the needs of
the Audit Committee of the Board of Directors. Lou Digiovine,
then Audit Project Manager at a Fortune 500 company,
realized that this process had merit, and decided to
implement it.
A traditional CSA workshop brings
business people together to talk about risks and processes
specific to the goals and objectives of a business area.
To make a workshop successful, participants need to
be honest and open with their feedback. However, because
of the meeting-room environment, the staff members of
a given department are not necessarily going to openly
criticize their processes, even if such criticism is
the best thing for the company. This is especially true
when the creators of those processes are present. In
addition, some people are not comfortable speaking in
a group situation and others "over-participate".
Lou Digiovine had to find a way to allow dialogue to
occur in a safe and balanced environment, and felt the
way to do this would be to have some form of anonymous
brainstorming and voting. Thus a software solution was
pursued that would allow the rapid collection of honest,
anonymous data that could be quickly voted on in order
to reach consensus.
The Choice
A number of the products looked at
were strictly voting tools. Says Lou Digiovine, "Facilitate.com
turned out to be a lot more flexible, robust and significantly
less expensive. Being web-based, it could be used over
an intranet, which eliminated the need to travel with
a server/laptop. Although some nonweb-based solutions
were considered, they didn't provide the ability for
users to follow up after the fact unless they had the
applications loaded on their desktop computers, which
was not a viable option."
The Solution
In order to prepare for a facilitated
CSA workshop, Facilitate.com is used to administer a
survey to evaluate the Control Environment (a key concept
of COSO - Committee of Sponsoring Organizations of the
Treadway Commission) of the area under assessment. The
Control Environment - basically, the atmosphere in which
people in the company carry out their control responsibilities
- is the foundation for all other components of a company's
internal control structure.
After completing the survey, the collected
data is loaded into a conference, and is used as "seed
material" in the workshop. During the workshop,
the objectives of the organization are discussed, combining
verbal communication with the features of the software.
After discussion, individuals use the software to rate
the most important objectives for their organization,
and rank order those ratings to provide the focus of
discussion for the rest of the facilitated workshop.
Next, risks for the most critical
objectives are discussed. Using Facilitate.com's brainstorming
functionality, participants are allowed to add in new
risks, or comment on what was loaded into the software
from the survey data or input by other participants.
Using dual-criteria voting (significance and likelihood)
and Facilitate.com's quadrant mapping feature, a graphical
representation of the most critical risks is created
for discussion. A control discussion then takes place
to identify what is in place to mitigate those risks
and where there are gaps. Once again using the voting
feature, a consensus is reached as to whether the existing
controls are operating as intended and, if so, at what
level of efficiency.
Finally, the participants brainstorm on the types of
action steps that can be taken to address identified
gaps and ineffective and or inefficient controls. The
group votes on how critical each action element is to
accomplishing its intended goal. The most critical action
elements are handed over to the business lead for the
project who in turn creates action plans. The business
lead can continue to use Facilitate.com's "action
planning" mode to further develop the action plans
and track them through implementation.
The Results
Before Facilitate.com, these sessions
covered at most two or three business objectives. Now
up to six objectives - double the material - may be
covered. Facilitate.com enables more coverage in the
workshops, improved quality, and a better overall response
from the participants. In fact, Internal Audit is receiving
requests from business leaders to conduct these workshops
in their departments. Reports are turned around a lot
faster, and the workgroups have action plan elements
and meeting results in their hands when they leave the
session, or no later than the next day. Participants'
comments from both the workshops and the surveys are
much more frank and issues normally unspoken are uncovered.
Lou Digiovine summarizes it this way:
"It's often asked: How does Internal Audit know
that what they're being told is the truth? Obviously,
discretion must be used and occasional limited testing
must be performed if there is doubt. In general, though,
the responses obtained through the Control Self-Assessment
process using Facilitate.com are clearly candid. In
the end, Facilitate.com has helped break down barriers
to open dialogue, allowing the development of collaborative
plans to build a stronger, risk-managed organization."
|
