The traditional role of an IS auditor in a control self-assessment (CSA) should be that of a(n):