Control Self-Assessment

Control self-assessment (CSA), as the name suggests, is the self-assessment of controls by process owners. For CSA, the employee reviews the business process and evaluates the various risks and controls. CSA is a process whereby the process owner gains a realistic view of their own performance.

CSA ensures the involvement of the user group in a periodic and proactive review of risk and control.

The following are the objectives of implementing a CSA program:

• Make functional staff responsible for control monitoring
• Enhance audit responsibilities (not to replace the audit’s responsibilities)
• Concentrate on critical processes and areas of high risk

The following are some benefits of implementing a CSA program:

• It allows risk detection at an early stage of the process and reduces control costs.
• It helps in ensuring effective and stronger internal controls, which improves the audit rating process.
• It helps the process owner take responsibility for control monitoring.
• It helps in increasing employee awareness of organizational goals. It also helps the process owners understand the risk and internal controls.
• It provides assurance to top management about the adequacy, effectiveness, and efficiency of the control requirements.

Precautions While Implementing CSA

Due care should be taken when implementing CSA. It should not be considered a replacement for the audit function. An audit is an independent function and should not be waived, even if CSA is being implemented. CSA and an audit are different functions, and one cannot replace the other.

An IS Auditor’s Role in CSA

The IS auditor’s role is to act as a facilitator for the implementation of CSA. It is the IS auditor’s responsibility to guide the process owners in assessing the risk and control of their own environment. The IS auditor should also provide insight into the objectives of CSA.

Remember

An audit is an independent function and should not be waived, even if CSA is being implemented. Both CSA and an audit are different functions and one cannot replace the other.

Key Aspects for the CISA Exam

The following table covers important aspects from the CISA exam perspective:

Questions	Possible Answers
What is the primary objective of implementing CSA?	To monitor and control high-risk areas To enhance audit responsibilities
What is the role of the auditor in the implementation of CSA?	To act as a facilitator for the CSA program
What is the most significant requirement for a successful CSA?	Involvement of line management

Table 2.15: Key aspects for the CISA exam

You learned how CSA is a proactive assessment that aids auditing. Another important technique that further builds on the proactive method is Agile auditing. The following section discusses Agile auditing in detail.