Exam CRISC topic 1 question 1746 discussion

Audit results provide the most reliable and independent evaluation of control effectiveness because: They are conducted by qualified, objective professionals (internal or external auditors). Audits involve testing controls for both design adequacy and operating effectiveness. Findings are based on evidence, documented, and typically go through a quality assurance process. This makes audit results highly credible and actionable for assessing the current state of controls. Why not the other options? A. Business Impact Analysis (BIA): BIA helps prioritize recovery efforts and assess impact, not control effectiveness. B. Control Self-Assessment (CSA) results: Valuable for early insights, but may lack objectivity since they’re performed by control owners themselves. D. Key Performance Indicators (KPIs): Measure process performance, not necessarily control effectiveness.

CSA provides a framework for helping organisations to manage their risks to achieve their business objectives. In simple terms, CSA involves a structured approach to documenting business objectives, risks and controls and having operational management and staff assess the adequacy of controls B I think