Which of the following provides the GREATEST assurance that existing controls meet compliance requirements?

Question

Options

• APerforming risk assessments
• BEstablishing compliance metrics
• CReviewing security policies
• DEngaging independent audits

• A
  15% (4)
• B
  4% (1)
• C
  4% (1)
• D
  77% (20)

Explanation

Independent audits (D) provide the greatest assurance because they involve an objective third party systematically verifying that controls actually function as intended against defined compliance standards - this is evidence-based validation, not internal assessment.

Why the distractors fall short:

• A (Risk assessments) identify potential gaps and threats but don't verify whether existing controls are actually working or meeting requirements.
• B (Compliance metrics) track performance indicators but are typically self-reported internal measures - they can confirm activity without confirming effectiveness.
• C (Reviewing security policies) only examines documented intent; a policy can exist on paper while controls remain broken or unenforced in practice.

Memory tip: Think of the word assurance - in audit and compliance contexts, assurance requires independence. The higher the independence from the entity being evaluated, the higher the assurance. When a question asks for the greatest assurance, look for the option with the most external, objective validation method.

No community discussion yet for this question.