IT Management - Internal Audit

by: Even Jahr

Self Assessment or internal control is a regular process to be repeated again and again, as part of your efforts to reach the desired level of quality you are striving for. The self assessment process shows you if you are on the right track to achieve your goals, and it can also show you where you can find room for improvement in your working processes.

How to define the metrics.

What can you measure? Any working process in your department can be measured. Whether it is opening a new user account, setting up new a PC, ordering software, answering a call on the help desk - all these processes can be defined and measured. The way to do this is to set up a flow diagram, and define the working steps one by one until you have the defined the complete process. For each step in the process from beginning to end you should define the input needed to start the step, how the step is to be performed and finally, the result of the process. The process also involves defining 4 roles or levels of participation in the different steps of the process, execution defines the person who I doing the job, which normally means the person who is responsible. P for participation, who takes part in the process step, I for information, who, if any, needs to be informed about the result of the step. As you work your way through the process you are defining, make sure that all important steps to complete a process are included.

Have a special focus on the part of the process where you have little or no influence. Your interaction with other departments is important to measure, so define the steps where you need information from other departments or give information to other departments with great care. As an example, if you are defining how to open a new user account as a process, then you can have the following steps:

1) receive requisition for new user

2) crate new user on the network

3) Update user list

4) Update Hardware Inventory list

5) Update software licenses

6) Report back when everything is ready

If you in addition define the 4 levels of participation in the process, your procedure is ready.

How to do the self assessment / internal control. The self assessment is a process where you go through all the steps required to perform a task, step by step as defined in the procedure.

If the step is performed satisfactory, you have a situation that is called compliance. Compliance means that all is working well without errors.

If the step is not performed satisfactory, you have a situation we call non-compliance.Non-compliance means that there are some errors in performing the work, and these errors have to be corrected.

When you have compliance, you can complete your internal control. All is working well and according to procedure, just write a small report on your findings and send a copy to your immediate superior. Never forget the internal marketing you should do to improve your standings.

If you have a non-compliance situation, you will have to ask yourself the following questions: Are there errors in the way I perform the internal control? If you have errors in the way you do the internal control, it is easy to correct and then just repeat the process to see if your result is correct. Are there errors in the working procedures? A non-compliance situation may be a good indication. If the working procedure contains logical errors, people will bypass the steps you have defined simply because it prevents them from doing their job they feel it should be performed. After analyzing the situation and if you find errors in the procedure, correct the error, implement the procedure again and do a new self assessment. Are there errors in the implementation process? If the procedure is defined the way you want it to work and people do not follow it, then you have to consider your implementation process. Perhaps you have to repeat it, or discuss the steps where you have non-compliance with your subordinates so that they understand the importance of performing the procedure as described and not bypassing any of the steps. If there are errors in the procedure they have to be corrected, and a new training has to be done. If people bypass and the procedure works the way you want, a new training is also required. Self Assessment of your procedures is a very good tool to improve performance and verify that you keep the level you want.

More so, when you have a Service Level Agreement (SLA) with your users and you have to verify performance from time to time. Then self assessment becomes a part of your regular working routine and you can document your service level with your self assessment reports.