Annual control self-assessment results show that every control owner rated all of their controls as effective, although two significant incidents last year involved controls on the list. What is the MOST appropriate next step for the information security manager?
Select an answer to reveal the explanation.
Short Explanation
Asking someone to grade their own homework is fine, until the homework keeps failing in the real world. When self-ratings say everything's perfect and incidents say otherwise, you validate with independent testing, and you don't just make them sign the grade sheet harder.
Full Explanation
Control self-assessment is a useful, low-cost way to involve control owners, but its results are only as reliable as the independence and evidence behind them. When uniformly positive ratings contradict incident history, the information security manager should obtain independent validation, testing a sample of controls selected by risk, with priority given to those implicated in the incidents. This produces evidence about whether controls are designed and operating effectively and shows whether the self-assessment process itself needs better guidance or evidence requirements. A signed attestation adds formality but no new evidence; the same people are still confirming their own judgment. Replacing the program with external audits of every control each year is costly and not risk-based, and it discards a process that can work once calibrated. Accepting the ratings ignores clear contrary evidence; familiarity with a control does not make an owner an objective assessor of it. Exam caveat: self-assessment is not wrong in itself, and the answer is to validate it rather than abolish it. Operational check: compare independent test results with the owners' ratings for the sampled controls and, where they diverge, update the risk register and tighten the self-assessment evidence criteria.