SELF ASSESSMENT OF BUSINESS OBJECTIVES. Kelly Dorin CPA, CA, CIA, CFE, CCSA, CRMA

Transcription

1 SELF ASSESSMENT OF BUSINESS OBJECTIVES Kelly Dorin CPA, CA, CIA, CFE, CCSA, CRMA

2 Overview What is Control Self-Assessment (CSA) Benefits obtained from using CSA How would you use CSA Enterprise-wide CSA Voting Techniques The Balanced Scorecard

3 Definition Control Self-Assessment (CSA) is a technique that involves a subjective evaluation of an organization s risks and controls by the staff involved in these activities.

4 Employees Shared Responsibility The concept is based on the premise that responsibility for controls, performance, and quality is shared between all employees at all levels within an organization.

5 Employees know best It is the employees closest to the operations who are in the best position to know the strengths and weaknesses in their processes and programs.

6 Audit Potential VS Organizational Need

7 Benefits of using CSA Commitment to change is always greater when the people affected are involved in the identification of the need for change. The framework can be developed solely by your department or jointly with the audit team if desired. CSA can provide your department or the whole organization with a more comprehensive understanding of barriers to achieving objectives. CSA can increase the likelihood of your organization achieving its strategic objectives.

8 What are Objectives, Risks and Controls Objectives are things an organization wants to accomplish. Risks are things that might prevent accomplishing an objective. Controls are things that help meet an objective by managing that risk.

9 6 Primary Stages in CSA Process 1. Identifying key processes within Department. 2. Develop evaluation criteria within each process st Session - Have the group rate criteria. 4. Put together preliminary results nd session Walk through results in each process obtaining explanations for high risk ratings, and brainstorming on mitigating strategies. 6. Put together CSA Report to serve as an action plan for increasing the likelihood of achieving your strategic objectives.

10 1. Identifying key processes within Department 2. Develop evaluation criteria within each process.

11 You don t have to be a Clown to know how to audit the Circus.

12 CSA for UVic s Purchasing Services Department The Purchasing Services Department (PSD) proactively completed the CSA process in September 2013 for their department to identify their strengths and weaknesses, and to enhance their department s ability to achieve their strategic objectives.

13 Development of Criteria for Evaluation The117 questions that were developed for this self-assessment process were derived from procurement best practices primarily based on: the Core Procurement Policies and the BC Purchasing Handbook of the Province of BC; procurement publications from the National Institute of Governmental Purchasing; and The Institute of Internal Auditors.

14 The CSA Rating Scale that we used The survey component of Self-Assessment process asked PSD staff to rank each statement on a four point scale where a rating of 1 indicates strong controls and a rating of 4 indicates weak controls. A rating of 1 is appropriate when the respondent totally agrees with the statement. A rating of 2 means somewhat agree, 3 somewhat disagree, and 4 totally disagree.

15 Surplus Assets Disposed of in a Coordinated Way Every item acquired by UVic is a potential source of surplus. Surplus items originate from three basic sources: Scrap, waste and rubbish; Surplus, obsolete or damaged stocks; Surplus, obsolete or worn or damaged equipment. PSD is responsible for the disposal of all surplus materials and assets through re-allocation, direct sale, auction, trade, donation or landfill.

16 Establish Objective and Desirable Criteria A fully performing procurement function has processes in place to ensure that assets surplus to the organization s needs are disposed of in a co-ordinated way to maximize the dollar return, and to minimize the risk to the environment.

17 Consider Risks to Achieving Objective Risks to an effective disposal of surplus UVic assets Assets disposals are not made in terms of University policy; Assets may be sold, transferred or retired without management's knowledge; Asset disposals or transfers may not be communicated to appropriate personnel; and Assets may be disposed of at inappropriate prices.

18 Develop Questions and Vote *The risk ratings in this slide are not actual results, they are ratings that have been developed solely for presentation purposes.

19 Self-Assessment of Asset Disposal Processes PSD estimates that only 20% of surplus assets are being appropriately declared by departments. There is currently no Asset Management System, or asset disposal system in place to support effective processes for tracking assets. The Banner system has an asset management module, but it has never been implemented.

20 Why does Purchasing Services Department or UVic care if we don t have adequate processes in place to manage assets?

21 Opportunity for Improvement Undertake a review of departmental practices around inventories of significant assets and begin to test compliance with the Purchasing Policy asset disposal rules.

22 Average Rating of 1.8 *The risk ratings in this slide are not actual results, they are ratings that have been developed solely for presentation purposes.

23 Purchasing Services CSA Report

24 Key Processes for a Finance Function Control Environment Information and Communication Control Activities Monitoring

25 Key Processes for a Finance Function Control Environment Code of Conduct; Governance; Assignment of Authority and Responsibility; Hiring and Retention Practices; Fraud Prevention Prevention/Detection Controls; Analytical Procedures Manual or automated.

26 Key Processes for a Finance Function Information and Communication Internal Communication and Performance Reporting; Tone Setting related to financial policies and procedures; Board/Audit Committee Reporting; External Communications.

27 Key Processes for a Finance Function Control Activities: Policies and Procedures; Responding to Internal Audit recommendations to enhance the financial control environment; Ensuring that appropriate segregation of duties are in place to avoid misappropriation of assets; Accounts Reconciliations; System Balancing and Exception Reporting; Change Management

28 Key Processes for a Finance Function Monitoring Variance Analysis Reporting, Remediation Mechanisms to resolve financial errors identified, Management Triggers Embedded Within IT Systems Independent Assessment Mechanisms: Internal Audit Department; External financial statement auditor; Tax auditors; Research funding agency auditors, etc.

29 Finance - Development of Criteria for Evaluation The 159 questions that were developed for this self-assessment process were derived from financial best practices primarily based on criteria established by the Committee of Sponsoring Organizations (COSO) COSO is made up of 5 financial organizations and the organization s role is to develop comprehensive frameworks and guidance on risk management, internal control and fraud deterrence.

30 CSA for a Finance Function *The risk ratings in this slide are not actual results, they are ratings that have been developed solely for presentation purposes.

31 Control Activities Example Questions *The risk ratings in this slide are not actual results, they are ratings that have been developed solely for presentation purposes.

32 Control Environment Example Questions *The risk ratings in this slide are not actual results, they are ratings that have been developed solely for presentation purposes.

33 Information & Communication Questions *The risk ratings in this slide are not actual results, they are ratings that have been developed solely for presentation purposes.

34 Monitoring Example Questions *The risk ratings in this slide are not actual results, they are ratings that have been developed solely for presentation purposes.

35 Example of a CSA Report for a Financial Function

36 HR- Development of Criteria for Evaluation The 144 questions that were developed for this self-assessment process were derived from a series of handbooks dealing with auditing human resource functions. The handbooks were published by the Institute of Internal Auditors.

37 Key Processes for a Human Resource Function Attraction and Recruitment Health and Wellness. HR Strategy Labour Relations. Organizational Development Organizational & Work Design Performance Management Records Rewards. Transformational Leadership Effectiveness

38 Attraction and Recruitment Example Questions Evaluation Criteria Screening and selection methods identify the best qualified applicants to be offered employment Reference checks are conducted before offers of employment are made Standards of conduct requirements are provided with job offers HR periodically evaluates attraction strategies to ensure they are responsive to changing job market conditions *The risk ratings in this slide are not actual results, they are ratings that have been developed solely for presentation purposes.

39 Attraction & Recruitment Screening and Selection methods identify the best qualified applicants to be offered employment.

40 HR Strategy Evaluation Criteria HR monitors for legislative, regulatory, judicial and quasi judicial decisions that may impact UVic HR's information systems provide the human resources data and metrics needed to support the strategic, planning and operational needs of UVic The respective roles, responsibilities, authorities, and accountabilities of HR and Management are clearly defined, well understood and respected Appropriate consultations take place as part of the policy development process Web based technology is used to make policy, terms and conditions of employment and related human resources information available to staff and managers within UVic *The risk ratings in this slide are not actual results, they are ratings that have been developed solely for presentation purposes.

41 Labour Relations Evaluation Criteria Input of UVic's managers is sought as part of preparation for collective bargaining Managers know who to consult with and who has what authority when disciplinary actions are being considered UVic takes a consistent approach to discipline and as a result similar issues are dealt with in a similar fashion Managers support the planning and implementation of return to work strategies for recovering injured or ill employees At a corporate level UVic has effective working relationships with its union including respectful and open lines of communication *The risk ratings in this slide are not actual results, they are ratings that have been developed solely for presentation purposes.

42 Organizational Development Evaluation Criteria UVic is actively addressing succession management and knowledge transfer challenges Learning and development is addressed in employee performance plans UVic familiarizes new employees with the organization's vision/ mission/ values/customer service commitment, business plans, culture and organizational Results of employee engagement surveys are available to staff UVic surveys and measures employee engagement *The risk ratings in this slide are not actual results, they are ratings that have been developed solely for presentation purposes.

43 Organizational & Work Design Evaluation Criteria All UVic jobs have job descriptions Job descriptions present an accurate portrayal of responsibilities Job descriptions are periodically reviewed to ensure they remain current with actual responsibilities HR provides expert advisory services respecting the design of jobs and the allocation of responsibilities to jobs HR provides quality expert advisory services respecting the design of effective organizations *The risk ratings in this slide are not actual results, they are ratings that have been developed solely for presentation purposes.

44 Performance Management Evaluation Criteria HR provides expert advisory services respecting performance management UVic's incentive program is achieving its objectives by motivating performance Supervisors are held accountable for the timely evaluation of staff performance UVic supervisors are responsible for ensuring each employee has an annual performance plan Supervisors are expected to identify and resolve performance issues with their employees

45 Records Evaluation Criteria HR staff assure that there are appropriate safeguards to protect the personal information of employees HR staff, management and supervisors have easy access to the employee records they need to do their jobs HR staff comply with records retention standards *The risk ratings in this slide are not actual results, they are ratings that have been developed solely for presentation purposes.

46 Rewards Evaluation Criteria UVic's benefits plans provide flexibility so employees have some ability to tailor them to their needs UVic supports the maintenance of professional credentials by reimbursing association fees when they are a bona fide requirement of a job UVic employees consider both direct pay and the value of benefits to be their compensation UVic has standards to facilitate equitable and consistent administration of salaries UVic periodically conducts market reviews of the salary and benefits offered by its competitors by for talent to understand the company's placement in the market *The risk ratings in this slide are not actual results, they are ratings that have been developed solely for presentation purposes.

47 Transformational Leadership Effectiveness Evaluation Criteria UVic's managers have the skills needed to implement the business transformation and cultural shift objectives for people management UVic's managers are committed to the business transformation and cultural shift objectives for people management UVic's managers actively support the business transformation and cultural shift objectives for people management Managers have a clear understanding of UVic's business transformation and cultural shift objectives for people management Executives have clearly articulated UVic's business transformation and cultural shift objectives for people management *The risk ratings in this slide are not actual results, they are ratings that have been developed solely for presentation purposes.

48 Observations - Human Resource Function HR Strategy - The current human resources information management systems are not capable of supporting the strategic planning and operational needs Labour Relations - Concern with the level of knowledge managers have in the area of managing sick leave issues. Organizational Development - There is a need to pay more attention to addressing individual training needs as part of the performance planning process and that there are opportunities to better utilize technology to deliver programs. Performance Management - Staff feel that the criteria for performance-base bonuses are well defined but there appears to be some skepticism that the program is achieving its objectives by motivating performance. Rewards Unable to provide total compensation statements to individual employees (a best practice) because of the limitations of the management information systems. Transformational Leadership Effectiveness - Executives need to more clearly articulate and managers need to more clearly understand the objectives of the business transformation and culture shift for people management initiatives.

49 IT- Development of Criteria for Evaluation The 106 questions that were developed for this self-assessment process were derived primarily from two IT Frameworks. COBIT - The framework links business and IT goals while helping users become more thorough in addressing risk management. ITIL A framework of best practices for delivering IT Services.

50 Key Processes for a IT Function Custom Software Development Database Administration/Deployment Hardware and Software Testing IT Asset Inventory IT Services and Strategies Software Licensing and Deployment Technical controls

51 Custom Software Development Evaluation Criteria Are development activities carried out in accordance with a documented system development methodology? Are appropriate programming techniques utlized? Is code reused where appropriate? Is code received from vendors properly reviewed for compliance with UVic and industry standards? Is code unit tested against design specifications? *The risk ratings in this slide are not actual results, they are ratings that have been developed solely for presentation purposes.

52 Database Administration/Deployment Sub Section Evaluation Criteria Database Services Is there an alternate site containing a backup database should the primary one fail for any reason? Database Services Is third party access governed by contracts? Database Services Are computer equipment containing the database sufficiently protected against fire, flood and other Database Services Does the organization assess the impact if the production database should fail? *The risk ratings in this slide are not actual results, they are ratings that have been developed solely for presentation purposes.

53 Hardware and Software Testing Evaluation Criteria Are all of elements of a system tested before going into production? Are custom applications and code subject to user acceptance testing? Are problems with developed applications properly documented and followed up for correction? Are fallback procedures in place in case the custom application/code fails despite testing? *The risk ratings in this slide are not actual results, they are ratings that have been developed solely for presentation purposes.

54 IT Asset Inventory Evaluation Criteria Are systems, either developed or acquired meeting relevant requirements? Are IT assets properly disposed of and in a timely manner? Are IT assets containing sensitive and confidential information properly destroyed when no longer in use? *The risk ratings in this slide are not actual results, they are ratings that have been developed solely for presentation purposes.

55 IT Services and Strategies Evaluation Criteria Are key performance indicators (KPIs) in IT properly measured? Is service delivery in IT efficient and well-defined? Is top level management demonstrated commitment to information security? Is there an incident management process and is it appropriate for UVic? Is proper change management in place for IT? *The risk ratings in this slide are not actual results, they are ratings that have been developed solely for presentation purposes.

56 Software Licensing and Deployment Evaluation Criteria Are third party programming tools utilized appropriately? Does UVic have the appropriate number of licenses for purchased third party software? *The risk ratings in this slide are not actual results, they are ratings that have been developed solely for presentation purposes.

57 Technical controls Evaluation Criteria Are viruses and detected intrusion attempts followed up adequately? Is our systems protected against flood, fire and/or other natural disasters? Is the current anti-virus software adequate for UVics needs? Are regular updates of vulnerabilities in software from third parties received and implemented appropriately? Are systems protected by technical controls? *The risk ratings in this slide are not actual results, they are ratings that have been developed solely for presentation purposes.

58 Forced Ranking Tool

59 Forced Ranking Tool Type A for Fiji Type B for Mexico

60 Forced Ranking Tool Type A for Fiji Type C for Cuba

61 Forced Ranking Tool Type A for Fiji Type D for Hawaii

62 Forced Ranking Tool Type B for Mexico Type C for Cuba

63 Forced Ranking Tool Type B for Fiji Type D for Hawaii

64 Forced Ranking Tool Type C for Cuba Type D for Hawaii

65 Sumer Vacation Alternatives Forced Ranking Tool Group Priority My Totals My Priorities Group Total Group Priority A) Fiji B) Mexico C) Cuba D) Hawaii

66 The 1,000 Piece Puzzle

67 The 1,000 Piece Puzzle

68 UConnect voting exercise.

69 People Assessment of UVic s Strategic Plan Objectives 1 UVic is a diverse, welcoming learning community with a demonstrated commitment to equity and fairness. A Totally Agree B Somewhat Agree C Somewhat Disagree D Totally Disagree E Don t Know

70 People Assessment of UVic s Strategic Plan Objectives 2 UVic recruits and retains a diverse group of outstanding staff by providing rewarding and fulfilling careers. A Totally Agree B Somewhat Agree C Somewhat Disagree D Totally Disagree E Don t Know

71 Quality Assessment of UVic s Strategic Plan Objectives 3 UVic has developed library and scholarly information services that support the creation of knowledge within the university by serving the evolving information needs of students and researchers. A Totally Agree B Somewhat Agree C Somewhat Disagree D Totally Disagree E Don t Know

72 Community Assessment of UVic s Strategic Plan Objectives 4 UVic has successfully developed effective relationships with the diverse constituents that make up our local, regional, national, and international communities. A Totally Agree B Somewhat Agree C Somewhat Disagree D Totally Disagree E Don t Know

73 Resources Assessment of UVic s Strategic Plan Objectives 5 UVic has optimized the use of its human, financial, physical and information resources. A Totally Agree B Somewhat Agree C Somewhat Disagree D Totally Disagree E Don t Know

74 Resources Assessment of UVic s Strategic Plan Objectives 6 UVic has implemented a renewed records management system so as to increase administrative efficiency. A Totally Agree B Somewhat Agree C Somewhat Disagree D Totally Disagree E Don t Know

75 Evaluation of whole University using CSA

76 The Balanced Scorecard

77 Certification in Control Self Assessment

78 Certification in Control Self Assessment The Certification in Control Self-Assessment (CCSA ) exam tests your understanding of important CSA fundamentals, processes, and related topics such as risk, controls, and business objectives.

79 Voting Technology Available to You

80 Questions and Contact Information