CISA – Practice Question – Control self-assessment