Evaluating internal controls: control self-assessment in government.

• Author: Graves, Sharron M.
• Position: Includes related article

A system of internal control is a tool for ensuring that an organization realizes its mission and objectives. While internal controls are often thought to be the domain of accountants and auditors, it is actually management that has primary responsibility for proper controls. A critical element of any comprehensive internal control system is regular monitoring of the effectiveness of internal controls to determine whether they are well designed and functioning properly. (1) One technique for monitoring internal controls is the concept of control self-assessment, or GSA.

The Institute of Internal Auditors defines control self-assessment as "a process through which internal control effectiveness is examined and assessed. The objective is to provide reasonable assurance that all business objectives will be met." (2) As the term self-assessment implies, an organization's own employees--not external auditors or consultants--perform the evaluation of internal controls, usually with the help of the internal audit department. GSA provides an opportunity for management and/or internal auditors, along with operating staff, to join forces in objectively reviewing key business objectives, the risks involved in achieving those objectives, and the internal controls designed to manage those risks. (3) A properly implemented control self-assessment program is a powerful management tool.

Government managers and finance officers are well versed in the concepts and practices of internal control. GFOA first provided extensive guidance on the design, implementation, monitoring, and reporting of controls in its 1981 publication, How to Evaluate and Improve Internal Controls in Governmental Units. This publication has since been replaced by one entitled Evaluating Internal Controls: A Local Government Manager's Guide. Still, there is evidence that local governments in general are not familiar with the relatively new concept of control self-assessment. This article explains what GSA is and how it is being used by governments to enhance internal controls.

OVERVIEW

Control self-assessment was developed in Canada in the late 1980s but was not widely practiced in the United States until the mid 1990s, when companies began incorporating GSA as a major component of their audit strategies. The Institute of Internal Auditors embraced the concept in its infancy, and began sponsoring the annual GSA Users' Conference in 1993. Four years later, the IIA established the Control Self-Assessment Center to provide guidance, publications, seminars, and conferences on GSA implementation. By 1999, the IIA was offering a specialty certification for practitioners of control self-assessment--the Certification in Control Self-Assessment, or CCSA.

In control self-assessment, the evaluation of risks and controls is performed by personnel responsible for the work under evaluation. This causes a shift in some responsibilities related to internal control. Exhibit 1 compares the assignment of responsibilities under the traditional audit approach to the GSA approach. (4) Traditionally, the internal auditors evaluate and assess the adequacy of controls and prepare an audit report for management. Under the GSA approach, however, work teams comprised of operating staff issue this report directly to management.

Notice that responsibility for setting business objectives, assessing risks, and ensuring the adequacy of internal controls is the same under both approaches. However, responsibility for evaluating risks and controls and for reporting the results shifts from internal auditors to work teams. This reflects the fact that employees are in a better position to evaluate risks and controls relevant to their operations than either internal or external auditors.

BENEFITS OF SELF-ASSESSMENT

The primary benefit of control self-assessment is that it strengthens the internal control environment by involving operating units in the process. In Self-Assessment: Making a Choice, Glenda Jordan identified five major benefits of control self-assessment:

* GSA helps line employees at all levels better understand and assume responsibility and accountability for effective control and risk management

* Corrective action can be more effective because participants "own" the results

* GSA provides broader coverage on important issues because the experts, the work team, can quickly focus on key risks and controls

* GSA improves communication at all levels since workshops can include multiple locations, departments, functions, and levels of personnel

* CSA teaches participants how to analyze and report on internal control, thus helping to increase the control consciousness of the entire organization (5)

In our first survey, respondents...