Which term describes the process of management and staff identifying risk and controls with guidance from an auditor?

• A. Control risk self-assessment
• B. Control self-assessment
• C. Frequency analysis
• D. Business impact

Answer: (A)

Control risk self-assessment is the collaborative process where management and staff map out risks and the controls needed to mitigate them, with guidance from an auditor. This approach centers on evaluating not just that controls exist, but that they are properly designed and operating effectively to reduce residual risk to an acceptable level. Having an auditor guide the process brings objective criteria, evidence collection, and assurance that the assessment aligns with governance and audit standards. The broader term control self-assessment describes the activity without the explicit emphasis on risk focus and auditor guidance. Frequency analysis and business impact focus on how often events occur or the consequences of disruption, respectively, and don’t describe this auditor-guided, risk-control evaluation.