My favorite part of my job comes when I can help someone take a cumbersome process and simplify it using policyIQ. Knowing that I've just saved someone time in their busy day (or prevented a migraine caused by extreme frustration) puts a smile on my face.
For that reason, when I work with any client who is using policyIQ to track internal controls, I want to learn about their process for gathering self-assessments from their control owners for those controls.
Why perform Control Self-Assessments?
Most organizations tracking Internal Controls have some process in place for collecting an assessment of the control from the control owner. Who better than the person who performs the control to tell you:
- Is the control currently documented correctly (as it is actually performed)?
- Is the control designed in a way that effectively mitigates the risk?
- Is the control operating effectively?
- Is the control efficient? Is there a better way to mitigate that risk?
Okay - so very few organizations are asking that last question - but why not? If you are already reaching out to control owners, why not take the opportunity to find out if there are better ideas out there? And if your control owners are given an opportunity to offer their "better" suggestions and have a sense of ownership over their duties, they are less likely to complain about the process. (At least, they are less likely to complain out loud.)
What does your Control Self-Assessment process look like?
If you are currently doing Control Self-Assessments, what does your process look like? Does it involve a spreadsheet and email? Are there reports to be run in advance, worksheets to be compiled for each control owner, and emails to be sent out?
Do you find yourself spending hours trying to track people down to get those spreadsheets back? Are you combing through your email Folders to figure where you accidentally misfiled that response from the CFO, because you know you received it but now you can't find it and you REALLY don't want to tell her that you lost her email?
Are you then recompiling a hundred or more responses into a new spreadsheet and making updates to your final documentation in policyIQ?
Are you repeating this hassle every quarter, feeling like you've barely finished the last round when the new round of self-assessments need to be sent out? Or are you skipping it and doing it less frequently than you'd like, just because it's too much work.
STOP! We have a better way.
policyIQ Forms offer a really terrific solution for Control Self-Assessments, allowing you to create a List of Forms that gets sent out to Control Owners on your preferred frequency asking them to review the most current control documentation (already in policyIQ and linked to their forms). The process solves a number of headaches for you:
- You don't have to create a report and send something out of policyIQ to the Control Owner. You are asking them to log in and review the most current information in your primary system of record. (Time saved and errors avoided!)
- Easily track who has responded and who has not. Send email reminders to those who still must submit their responses!
- Reporting lets you easily narrow down which responses you must review and act on - such as ONLY those responses where changes must be made or on which the Control Owner has indicated an ineffective design or operation.
- You'll never "lose" a response. Everything is submitted within policyIQ - and will be retained for reporting and audit purposes alongside all other internal control and testing information.

Get started with a better Control Self-Assessment process today!
Convinced? Fired up? Ready to go? If you are like most organizations, your third quarter of the year has just started on July 1st, so you have lots of time to put a new plan in place for Q3 Self-Assessments! (Want to do Q2 Self-Assessments? Stop reading and call us right now - we'll get you started.)
We can't lie - setting up a new Control Self-Assessment Form List can take some time. Our recommended setup is to create a Form List with a Form customized for every Control that should have a self-assessment completed. The "customization" means linking the Form to the Control Page in policyIQ, assigning it to the appropriate Control Owner, and editing the name to reflect the Control in question.
But after that initial setup, the process practically runs itself - and the time you save just within the first Control Self-Assessment cycle will make it worthwhile! Once set up, you simply copy your work from last quarter, make any adjustments that you need to for new Controls or changes in Control Owner. If the Control details have changed, you don't have to worry about it. You've already made the updates in policyIQ - and your Control Owners will be looking at the most recent documentation!
Your online policyIQ Help has detailed step-by-step instructions on how to set up your Form Template, Form List and Forms for Control Self-Assessments. Follow the navigation displayed below - or just click on the image to launch into the Help page on this topic!

Questions? Want to talk about other ways to customize the process? Contact us at support@policyIQ.com and we'd be happy to discuss it!