Certified in Risk and Information Systems Control (CRISC) — Question 1429

An organization wants to assess the maturity of its internal control environment. The FIRST step should be to:

Answer options

• A. identify key process owners.
• B. validate control process execution.
• C. determine if controls are effective.
• D. conduct a baseline assessment.

Correct answer: D

Explanation

The correct answer is D, as conducting a baseline assessment is essential to understand the current state of the internal control environment before any further actions are taken. Options A, B, and C are important steps but should follow the initial assessment to evaluate existing controls and their effectiveness.