A city CIO must choose assessors for the annual review of the tax-collection system and wants both independence and deep knowledge of legacy workflows. Which approach best balances those tradeoffs?
Select an answer to reveal the explanation.
Short Explanation
Independence and tribal knowledge pull in opposite directions. Bring in outsiders to grade the controls, and keep internal SMEs nearby as guides—not graders. Pure insiders, pure strangers, or hallway chats tip the balance the wrong way.
Full Explanation
Independence and contextual knowledge are complementary assessment design goals for a municipal tax-collection system, not interchangeable substitutes. Pairing an external firm to evaluate and score controls with internal subject-matter experts who explain legacy workflows—without grading their own work—preserves objectivity while preventing shallow findings rooted in ignorance of how the city’s processes actually operate. External assessors reduce self-review bias that appears when builders certify their own implementations; internal SMEs supply tribal knowledge about batch cycles, exception queues, and historical workarounds that outsiders would otherwise miss. The hybrid model therefore produces assurance that is both credible to oversight bodies and accurate about residual risk in real municipal operations.
Relying solely on the internal staff who built the system maximizes institutional knowledge but collapses independence: self-assessment rarely surfaces design assumptions, deferred hardening, or political pressure to understate findings. Outsourcing every interview to a vendor that has never seen the city environment maximizes independence on paper yet injects knowledge risk—misinterpreted workflows, false positives around intentional compensating controls, and missed high-impact legacy paths. Informal hallway walkthroughs by department heads are not a formal assessment method; they lack scoped objectives, evidence standards, documentation, and independence, so they cannot support management attestation or regulatory scrutiny.
Exam caveat: CISSP Domain 6 emphasizes designing assessments that manage the tradeoff between objectivity and context; ‘independence’ does not mean ‘zero insider involvement,’ and ‘deep knowledge’ does not justify builders scoring their own controls. On the exam, prefer blended teams with clear role separation over pure insider or pure outsider extremes when both goals are stated.
Operational check: Document roles in the engagement letter—external assessors own scoring and reporting; internal SMEs provide process briefings and evidence location only. Require conflict-of-interest disclosures, retain workpapers showing who evaluated each control, and brief the CIO on residual bias risks if any control owner participated beyond facilitation.