Question

An IS auditor is asked to help business unit managers implement a control self-assessment (CSA) program using a facilitated workshop approach. During the first workshop, the participants begin looking to the auditor to identify the control weaknesses and prescribe the corrective actions. What is the MOST appropriate action for the auditor to take to preserve the integrity of the CSA process?

Accepted Answer

Act as a facilitator and guide the participants to identify and assess the risks and controls themselves

Answer

Document the control weaknesses identified and issue them as formal audit findings

Answer

Take ownership of the control assessment to ensure objectivity and consistency across business units

Answer

Assign remediation responsibility to the workshop participants and set completion deadlines