The IS auditor’s PRIMARY role in control self-assessment (CSA) is to: