Auditing Information Systems, Second Edition

10.3. KEYS TO A SUCCESSFUL PROGRAM

Control Self-Assessment is still in an early growth stage in its evolution. Relatively few organizations have taken the plunge and made the commitment of time and resources necessary to develop and implement an effective CSA process. As with any new business venture, there are risks involved with the implementation of CSA. The purpose of this section is to help reduce those risks so that the CSA program can be successful and to identify six key elements of a successful CSA program.

The most important part of any CSA program is the need to obtain the encouragement and support of senior management. Without their backing, lower levels of management will not be anywhere near as likely to take the process seriously. Without serious participation, a CSA program could be viewed as a waste of time. Senior executives and others who support and promote CSA are fondly referred to as "champions" by those in the CSA arena. Senior management support must be earned through effective demonstrations of the potential for significant gains in operational efficiency and effectiveness, and reductions in exposure to financial, regulatory, and other significant risks. These demonstrations can be supported by success stories at various companies that have implemented successful CSA programs (e.g., MAPCO, Inc.). Articles written about CSA (see previous section) may need to be referred to, and senior management may have to be better educated on the objectives of internal ...