Which of the following is the PRIMARY responsibility of an IS auditor in a control self-assessment (CSA) activity?

The correct answer is C. Facilitating CSA discussions to help the organization understand the risks and controls. In a Control Self-Assessment (CSA), the paradigm shifts from traditional auditing: management and process owners perform the actual assessment of controls, while the IS auditor acts as a facilitator. The auditor's role is to guide structured workshops or surveys, help participant

Submitted by yaw92· Apr 18, 2026Information System Auditing Process

Question

Options

APerforming the CSA by evaluating the effectiveness of the organization's controls
BRetesting failed controls to validate CSA findings and concerns
CFacilitating CSA discussions to help the organization understand the risks and controls
DDeveloping action plans to mitigate the identified control weaknesses

How the community answered

(60 responses)

A
7% (4)
B
2% (1)
C
88% (53)
D
3% (2)

Explanation

In a Control Self-Assessment (CSA), the paradigm shifts from traditional auditing: management and process owners perform the actual assessment of controls, while the IS auditor acts as a facilitator. The auditor's role is to guide structured workshops or surveys, help participants understand risks and controls, and ensure the process runs objectively - not to independently evaluate controls (A), which would be a traditional audit function. Retesting failed controls (B) and developing action plans (D) are management responsibilities that fall outside the auditor's CSA facilitation role and would compromise the self-assessment nature of CSA.

Topics

#Control Self-Assessment (CSA)#IS Auditor Roles#Audit Methodologies#Risk and Control Facilitation

Community Discussion

No community discussion yet for this question.

Full CISA Practice