Which statement best describes a Control Self-Assessment (CSA) process?

• A. A unit-based review of controls conducted by the control owner to identify gaps and remediation needs.
• B. A quarterly external audit of all controls by an independent firm.
• C. A financial model for predicting risk exposure.
• D. A certification program for employees.

Answer: (A)

Control Self-Assessment is about control owners in each unit taking responsibility for checking the controls they oversee. They review whether the controls are properly designed and actually operating as intended, gather evidence, spot gaps or weaknesses, and outline remediation actions with clear owners and timelines. This self-review approach fosters ownership, enables early detection of issues, and feeds the findings into the broader risk management process. It differs from an external audit, which is conducted by an independent party on a set schedule, and it is not a financial model for predicting risk exposure nor a certification program for employees.