The team that operates the privileged access management control has offered to test its effectiveness for the annual assurance report presented to the board. What is the MAIN concern with this arrangement?
Select an answer to reveal the explanation.
Short Explanation
You wouldn't let students grade their own exams and then hand the results to the principal. The people who run a control have every reason, conscious or not, to find that it works. The trap is the skills worry: you've got the people who know it best, but they're the wrong people to judge it.
Full Explanation
Assurance provided to the board depends on objectivity. When the people who operate a control also test it, they are assessing their own work, which creates a conflict of interest and a risk, conscious or unconscious, of overlooking failures, choosing favorable samples or interpreting exceptions generously. Independent testers, whether a separate internal function or an external party, provide more reliable evidence for governance decisions. Concern about skills is misplaced here: the operating team probably understands the control better than anyone, which makes its members valuable sources of information but does not make them objective evaluators. Testing duration is a resourcing question and not a matter of assurance quality; an independent test may be faster or slower depending on scope. The board's ability to interpret technical results is a reporting challenge addressed by translating findings into business risk terms, and it does not affect whether the test itself can be relied on. Exam caveat: control owners and operators do perform useful self-checks and self-assessment, but results used for formal assurance to senior governance bodies require independence or independent validation. Operational check: confirm that the assurance plan names a tester with no operational responsibility for the control and that results are reviewed by someone outside the operating team.