A control self-assessment (CSA) is a technique that allows managers and work teams directly involved in business units, functions, or processes to participate in assessing the organization's risk management and control processes. The main purpose of conducting a CSA is to gain a better understanding of the control effectiveness in the organization, which means how well the controls are designed, implemented, and operated to achieve the desired outcomes and mitigate the risks. A CSA can help to identify the strengths and weaknesses of the existing controls, as well as the gaps and opportunities for improvement. A CSA can also help to enhance the awareness, ownership, and accountability of the control environment among the managers and staff. The other options are not the main purpose of conducting a CSA, although they may be related or beneficial. Gaining a better understanding of the risk in the organization is a result of conducting a CSA, but it is not the primary goal. The primary goal is to evaluate the controls that address the risks, not the risks themselves. Adjusting the controls prior to an external audit is a possible action that may follow a CSA, but it is not the reason for conducting a CSA. The reason for conducting a CSA is to improve the control effectiveness, not to prepare for an audit. Reducing the dependency on external audits is a potential benefit of conducting a CSA, but it is not the objective of conducting a CSA. The objective of conducting a CSA is to enhance the internal control assurance, not to replace the external audit assurance. References = CRISC Review Manual, pages 153-1541; CRISC Review Questions, Answers & Explanations Manual, page 802

The best method of creating risk awareness in an organization is to ensure senior management commitment to risk training. Senior management plays a vital role in setting the tone and direction of the risk culture and governance in the organization. By demonstrating their support and participation in risk training, they can influence and motivate the employees to follow the risk policies and procedures, and to enhance their risk knowledge and skills. Marking the risk register available to project stakeholders, providing regular communication to risk managers, and appointing the risk manager from the business units are other methods of creating risk awareness, but they are not as effective as ensuring senior management commitment to risk training. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 12; CRISC Review Manual, 6th Edition, page 215.

The best way to prevent future occurrences of active network accounts belonging to former employees is to conduct a comprehensive review of access management processes. This review should include verifying that the access rights of all employees are updated regularly, especially when they change roles or leave the organization. The review should also ensure that there are clear policies and procedures for granting, modifying, and revoking access rights, and that these are followed consistently and documented properly. The review should also identify and address any gaps or weaknesses in the access management processes that could lead to unauthorized or inappropriate access. By conducting a comprehensive review of access management processes, the organization can improve its security posture and reduce the risk of data breaches or misuse of resources. References = IT audit: The ultimate guide [with checklist] | Zapier, IT auditing and controls - planning the IT audit [updated 2021]

The main purpose of a risk register is to enable well-informed risk management decisions by providing a comprehensive and up-to-date record of all the identified risks, their analysis, and their responses. A risk register is a tool that helps to document, monitor, and communicate the status and outcome of risk management activities. A risk register also facilitates the review and evaluation of the effectiveness of risk management processes and controls. Documenting the risk universe, promoting an understanding of risk,and identifying stakeholders are possible benefits of a risk register, but they are not the main purpose. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 2, Section
2.1.1.3, page 531
1: ISACA Certified in Risk and Information Systems Control (CRISC) Exam Guide, Answer to Question
640.

The main purpose of reviewing a control after implementation is to validate that the control operates as intended, as this can help to ensure that the control is effective and efficient in mitigating the risk, and that it meets the control objectives and requirements. Reviewing a control after implementation can also help to identify and address any issues or gaps that may arise during the control operation, and to monitor and evaluate the performance and impact of the control. Reviewing a control after implementation can also provide feedback and information to the control owners and stakeholders, and enable them to adjust the control design and implementation accordingly. References = Most Asked CRISC Exam Questions and Answers. CRISC: Certified in Risk & Information Systems Control Sample Questions, Question 254. ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, Question 254. CRISC by Isaca Actual Free Exam Q&As, Question 9.