The information security manager plans to have business units assess their own controls through control self-assessment. What is the MOST important consideration to ensure the results can be relied on?
Select an answer to reveal the explanation.
Short Explanation
Self-assessment is like asking people to weigh themselves at home: handy and it gets them engaged, but you'd still want to check the scales now and then. Ownership is the upside; optimism is the risk. The trap is treating the self-assessment as if it were independent testing.
Full Explanation
Control self-assessment engages business units in evaluating their own controls, which builds ownership, spreads awareness of risk and extends coverage at modest cost. Its weakness is that results come from the people responsible for the controls, so they may be optimistic, inconsistent or based on misunderstanding of the control objective. Independently validating a sample of results, through the security function or internal audit, calibrates the process, reveals units whose assessments are unreliable and gives management a basis for trusting the overall picture. Replacing internal audit's testing with self-assessment removes the independent assurance that governance relies on and would weaken oversight rather than strengthen it. Allowing each business unit its own rating scale makes results incomparable across the organization and prevents consistent aggregation and reporting. Keeping results from senior management defeats one of the main purposes of the exercise, which is to give leadership visibility of control health and to support decisions on risk. Exam caveat: CISM expects self-assessment to complement, not replace, independent assurance, and to use common criteria and guidance. Operational check: select a risk-based sample of self-assessed controls each cycle, test them independently, compare the ratings and track the rate of disagreement by business unit to target coaching.