CRISC · Question #536
Which of the following is the MOST reliable validation of a new control?
The correct answer is D. Internal audit review of control design. The most reliable validation of a new control's effectiveness and proper implementation comes from an objective, independent internal audit review of its design and operational aspects.
Question
Which of the following is the MOST reliable validation of a new control?
Options
- AApproval of the control by senior management
- BComplete and accurate documentation of control objectives
- CControl owner attestation of control effectiveness
- DInternal audit review of control design
How the community answered
(16 responses)- A13% (2)
- B19% (3)
- C6% (1)
- D63% (10)
Why each option
The most reliable validation of a new control's effectiveness and proper implementation comes from an objective, independent internal audit review of its design and operational aspects.
Senior management approval indicates organizational buy-in but doesn't validate the technical design or operational effectiveness of the control.
Complete and accurate documentation is essential but only describes the control; it doesn't validate its actual functioning or effectiveness.
Control owner attestation is a statement of belief or compliance by the person responsible for the control, but it lacks the independence and rigorous testing that an audit provides for true validation.
An internal audit review provides an independent, objective assessment of whether the control is designed appropriately to meet its objectives and is operating as intended. This review typically includes testing and verification, making it the most reliable method of validation compared to self-attestation or documentation.
Concept tested: Control validation methods
Source: https://learn.microsoft.com/en-us/azure/compliance/control-review
Topics
Community Discussion
No community discussion yet for this question.