Auditing Information Systems, Second Edition

10.1. DEFINITION AND OVERVIEW

Following is my definition of control self-assessment:

Control Self-Assessment (CSA) is a leading edge process in which auditors facilitate a group of staff members who have expertise in a specific process, with the objective of identifying opportunities for internal control enhancement pertaining to critical operating areas designated by management.

The CSA process is usually accomplished during workshops. Note in the definition that the words auditors, staff members, and management have been italicized. The reason is to emphasize that a CSA workshop can be successful only through the combined positive efforts of each of these three groups of individuals, or players. If any one of the players does not adequately perform his or her role, constructive ideas to enhance the internal control environment will not be as effective as they otherwise could have been.

Other key words in the CSA definition are facilitate, identifying, and critical. Each key word relates to the role that each of the three groups of CSA players must perform. Successful CSA depends on auditors effectively facilitating a lively, open, honest, and constructive session. Without effective facilitation, a CSA workshop can easily wander into irrelevant topics or negative discussions about problems with other individuals or departments that do not pertain to the objectives of the workshop. This can result in wasting valuable time and resources.

Staff members are also essential to the ...