Question

A risk manager wants to increase business unit engagement in control monitoring while reducing reliance on periodic internal audit reviews. Operational managers currently view control assessment as a compliance burden imposed by others. Which approach would BEST address this situation?

Accepted Answer

Implement a control self-assessment (CSA) program in which process owners periodically evaluate the design and operation of their own controls

Answer

Increase the frequency of independent internal audit engagements across all business units

Answer

Centralize all control testing within the second-line risk function to ensure consistency

Answer

Require each business unit to outsource its control testing to an external assurance provider