A self-assessment is a walk-through or reperformance of a control, or another procedure to analyze the operation of controls, performed by an individual who might or might not be involved in operating the control. A self-assessment could be done by personnel who operate the control or members of management who are not responsible for operating the control. The evidence of operating effectiveness from self-assessment activities depends on the personnel involved and how the activities are conducted.
A self-assessment performed by personnel who operate the control would normally be supplemented with direct testing by individuals who are independent from the operation of the control being tested and who have an equal or higher level of authority. In these situations, direct testing of controls would be needed to corroborate evidence from the self-assessment since the self-assessment alone would not have a reasonable level of objectivity.
In some situations a certifying officer might perform a self-assessment and the certifying officer is involved in operating the control. Even if no other members of management independent from the operation of the control with equal or higher level of authority can perform direct testing, the certifying officer’s self-assessment alone would normally provide sufficient evidence since the certifying officer signs the annual certificate. In situations where there are two certifying officers and one is performing a self-assessment, it would be appropriate for the other certifying officer to perform direct testing of the control.