CONTROL SELF ASSESSMENT IN RETAIL STORE AUDITS

Every successful audit is based on sound planning and an
atmosphere of constructive involvement and communication between the auditor and
the auditee. The purpose of writing this article is to provide insights on the
use of a tool for organisations with dispersed geographical locations,
especially the retail sector.

Any corporate body establishes Internal Controls & Procedures
to ensure that employees abide by laws, regulations and human resources policies
when performing tasks. One of the many tools available to gauge internal control
effectiveness for organisations is the Control Self Assessment (CSA) activities.

The Institute of Internal Auditors (IIA) defines control and
control processes as :

“A control is any action taken by management, the board, and
other parties to manage risk and increase the likelihood that established
objectives and goals will be achieved. The management plans, organises, and
directs performance of sufficient actions to provide reasonable assurance that
objectives and goals will be achieved.

Control processes are the policies, procedures, and
activities that are part of a control framework, designed to ensure that risks
are contained within the risk tolerances established by the risk management
process. Risk management is a process to identify, assess, manage, and control
potential events or situations to provide reasonable assurance regarding the
achievement of the organisation’s objectives.”

Designed to discourage errors or prevent irregularities from
occurring. They are proactive controls that help prevent a loss. Examples :
Separation of duties, proper authorisation, adequate documentation, and physical
control over assets.

Designed to find errors or irregularities after they have
occurred. Examples : Reviews, analyses, variance analyses, reconciliations,
physical inventories and audits.

Internal controls are policies and instructions within an
organisation that top leadership puts into place to prevent losses resulting
from malfunction, employee carelessness, error, fraud and neglect. The
Sarbanes-Oxley Act of 2002, introduced as a consequences of internal control
failures across the globe, has emphasised that the need for internal control
compliance & documentation.

From a retail perspective, there is an increased attention to
governance, compliance and risk management spread across many thousands of
locations. This necessitates retailers to implement an appropriate store
compliance process in order to monitor the identification of issues and remedial
measures. Primary focus of retailers is on reducing costs, increasing margins,
reducing shrinks, balancing inventory levels, managing vendors, tackling
regulators and attracting customers.

An effective store compliance process can be achieved through
traditional store audits or through a self assessment technique.

Who is responsible for internal control? The auditors, right?
Wrong! Everyone plays a part in the internal control system. Ultimately, it is
the management’s responsibility to ensure that controls are in place. That
responsibility is delegated to each area of operation, which must ensure that
internal controls are established, properly documented and maintained. Every
employee has some responsibility towards the functioning of this internal
control system. Therefore, all employees need to be aware of the concept and
purpose of internal controls. Internal audit’s role is to assist management in
their overlooking and operating responsibilities through independent audits and
consultations designed to evaluate and promote the systems of internal control.

This is where CSA, as a technique, can play an important
role. Modern Internal Auditors need to understand and practise this technique.

The Institute of Internal Auditors (IIA) defines Control Self
Assessment as :

“Control self assessment (CSA) is a technique that allows
managers and work teams directly involved in business units, functions or
processes to participate in assessing the organisation’s risk management and
control processes. In its various forms, CSA can cover objectives, risks,
controls and processes.”

Internal auditors can utilise CSA programmes for gathering
relevant information about risks and controls; for focussing audit work on high
risk, unusual areas; and to forge greater collaboration with operating managers
and work teams. Business Managers can utilise CSA programmes to clarify business
objectives and to identify and deal with the risks in achieving those
objectives.

Internal auditors, in a consulting role, often act as facilitators to help managers in the assessment of risks and controls. Involvement of people working in evaluation of risks and controls utilises the expertise of the organisation, increases buy-in to any action items and focusses efforts on important business activities.

However, CSA is not a complete process by itself. It does not substitute the auditing effort. The audit function has to validate the CSA results, develop the remedial action plan and ensure a timely follow-up on issues identified during the CSA process. This combined effort is the most cost effective and result-oriented method of monitoring all stores on a regular basis.

Benefits of CSA in retail:

Pre-requisites of an effective CSA in retail:

    Lastly, ‘above par’ facilitation skills of the Internal Auditor. In most successful implementation of CSA, the top-most reason for successes has been the facilitation skills of the Internal Auditor.

Undoubtedly, CSA is an integrated part of the audit process for mitigating risks and adding value to the organisations, especially in retail.