An IS auditor has been asked to provide support to the control self-assessment (CSA) program. Which of the following BEST represents the scope of the…

The most appropriate role for an IS auditor in a Control Self-Assessment (CSA) program is that of a facilitator. In this capacity, the auditor leverages their expertise in risk management and control frameworks to guide and support business process owners in evaluating their own control environments. The auditor's function is to provide the methodology, training, and facilitation skills necessary for the business units to effectively conduct the self-assessment. This collaborative approach empowers management and staff, who are the control owners, while ensuring the CSA process is structured and effective. The auditor does not perform the assessment but rather enables the business to do so, maintaining the principle of business ownership of controls.

B. Improving process productivity is a management objective and a potential byproduct of effective controls, not the auditor's primary scope in a CSA.

C. Performing detailed audit procedures describes a traditional audit; in a CSA, the auditor's role is to guide the business in performing its own assessment.

D. The auditor's presence is to support and facilitate the process; it does not absolve other team members of their audit and control responsibilities.

1. ISACA. (2019). CISA Review Manual

27th Edition. Section 1.4.4 Control Self-Assessment (CSA)

p. 53. The manual states

"In a CSA program

the audit role is one of a consultant or facilitator... The IS auditor’s role may be to act as a facilitator in CSA workshops."

2. ISACA. (2015). "Implementing a Control Self-assessment Program." ISACA Journal

Volume 4. This article clarifies

"The role of internal audit in a CSA program is that of a facilitator... Internal audit provides the methodology

training and facilitation skills to help the business assess its risks and controls."

3. Engel

R.

& Hunton

J. E. (2008). "An Examination of the Effect of Control Self-Assessment on an Auditor's Control Risk Assessments." Auditing: A Journal of Practice & Theory

27(1)

117-134. https://doi.org/10.2308/aud.2008.27.1.117. This academic paper discusses the evolving role of auditors in CSA

highlighting the shift from direct testing to a more collaborative and facilitative partnership with management.