What is the term for the method by which management and staff at all levels collectively identify and evaluate risk and controls with their business areas, possibly under the guidance of a facilitator such as an auditor or risk manager?

What is the term for the method by which management and staff at all levels collectively identify and evaluate risk and controls with their business areas, possibly under the guidance of a facilitator such as an auditor or risk manager?

• A. Control self-assessment
• B. Control risk self-assessment
• C. Detective control
• D. Business impact analysis (BIA)

Answer: (B)

The method is a collaborative, bottom-up process where people who run the business with management support identify and evaluate risks and the effectiveness of controls within their own areas, often guided by a facilitator such as an auditor or risk manager. This approach is known as control self-assessment. It emphasizes ownership by the people closest to the processes, improves the accuracy of risk information, and supports ongoing risk management and governance. Detractors include detective controls, which detect incidents after they occur rather than guiding a collaborative risk-and-control review, and business impact analysis, which focuses on identifying critical functions and their impacts rather than evaluating controls across the organization. The term control risk self-assessment is less standard; the established term for this participative process is control self-assessment.

The method is a collaborative, bottom-up process where people who run the business with management support identify and evaluate risks and the effectiveness of controls within their own areas, often guided by a facilitator such as an auditor or risk manager. This approach is known as control self-assessment. It emphasizes ownership by the people closest to the processes, improves the accuracy of risk information, and supports ongoing risk management and governance.

Detractors include detective controls, which detect incidents after they occur rather than guiding a collaborative risk-and-control review, and business impact analysis, which focuses on identifying critical functions and their impacts rather than evaluating controls across the organization. The term control risk self-assessment is less standard; the established term for this participative process is control self-assessment.