AD-00018

Control Self-Assessment workshops often take place in small face-to-face meetings.  Participants examine risks and controls in their area, and create action plans to implement or improve existing controls.  Meetingworks lends itself extremely well to CSA workshops because of the anonymous input, efficient action planning, and thorough and timely documentation of the process.

Many companies and organizations use Meetingworks products to conduct their CSA's.  Some use the workshop approach to examine risks and controls; others assess themselves using the COSO Model (Committee on Sponsoring Organization), and formulate action plans where there is less than adequate coverage of an element.

British Petroleum uses a "Boston Square" type of analysis, where risks are categorized (using Organize) as high, medium, or low "probability" and "manageability".  The matrix consists of 9 squares, numbered left to right 1 to 3, 4 to 6, and 7 to 9.  Each risk is examined first for how much control over it they have (manageability), where 1 = low and 3 = high.  Then the same risk is discussed relative to probability (moving it up from where it landed in the first question).  A medium probability would place a risk in the 4 to 6 squares; high probability would place it in the 7 to 9 squares.

Next the group talks about the "impact" of the risk.  The risk can be moved up or down if the impact is very high or very low.  If the impact is medium, it stays in the square it already occupied.

The group then creates action plans for the risks with high manageability, high probability, and high impact (square 9).  They work their way down until they have worked through action plans for the 9, 8, 7, and 6 squares.