A quantitative assessment of internal controls: internal auditors can fortify their assurance efforts by implementing a systematic, framework-based approach to control reviews

Internal Auditor, April, 2005 by William E. Perry, H.C. "Pete" Warner

4. ASSEMBLE A GROUP OF EXAMINERS

Scoring the application requires a unique skill set. Mainly, the individual who performs this work--the examiner--needs to possess skills and knowledge specific to the scoring process. The examiner needs to understand the model used and be able to document controls against that model using the chosen method of scoring. He or she also needs to know how to document the scoring results and prepare an assessment report for the organization.

Ideally, two or more examiners should score the application independently. One of these individuals should be designated the senior examiner--this person should be able to perform the scoring work as well as manage the overall process. The senior examiner should also be responsible for making scoring decisions and writing the assessment report.

The assessment team should be composed of individuals with backgrounds that would facilitate successful implementation of quantitative measurement. Team members most likely would come from internal auditing, quality assurance, risk management, financial management, or external consulting groups.

5. SCORE THE INTERNAL CONTROL APPLICATION

Once the scoring team has been assembled, examiners can begin their work. The scoring process involves the following four tasks.

* EVALUATE EACH CONTROL OBJECTIVE The examiners first study the organization's control documentation and familiarize themselves with the system of internal controls. Then, for each control objective, examiners identify and document the strengths and weaknesses of the organization's approach to, deployment of, and methods for assessing the effectiveness of controls. When each of a control component's objectives has been assessed, the examiner lists what he or she believes are the major strengths and weaknesses.

* SCORE INDIVIDUAL CONTROL OBJECTIVES AGAINST A MODEL Following the process described in Step 3, examiners use the selected model to determine the percentage of the maximum score available for each control objective under review. The examiners should continue this process until they have scored all of the control objectives and accumulated an overall quantitative score for internal control.

* RESOLVE DIFFERENCES BETWEEN EXAMINERS Any differences in scoring between the examiners should be resolved under the direction of the senior examiner. Where differences exist, the individual examiners should be asked to justify their score by describing what they believe are the strengths and weaknesses of the control objective in question and how they determined the level of control effectiveness achieved for that objective. Although there are many processes for reaching consensus, the specific method used is generally immaterial, as long as all parties are proficient with that method.

Conflict resolution should continue until a consensus score has been developed for the organization. The overall consensus should include a consensus score for each control objective and control component, as well as a consensus of the major strengths and weaknesses within control objectives and control components.