Which method is NOT listed as a method of documenting systems and controls?

Which method is NOT listed as a method of documenting systems and controls?

• A. Narrative
• B. Flowchart
• C. Questionnaire / checklist
• D. Risk assessment

Answer: (D)

Documenting systems and controls is usually done using descriptions (narrative), visual representations of the process flow (flowchart), and structured evidence collection (questionnaire or checklist). A risk assessment, on the other hand, is about identifying and evaluating risks to determine where controls are needed and how strong they should be. It informs what controls should exist, but it isn’t a method for recording how the system and its controls are laid out. So the option that doesn’t fit as a documentation method is risk assessment.

Documenting systems and controls is usually done using descriptions (narrative), visual representations of the process flow (flowchart), and structured evidence collection (questionnaire or checklist). A risk assessment, on the other hand, is about identifying and evaluating risks to determine where controls are needed and how strong they should be. It informs what controls should exist, but it isn’t a method for recording how the system and its controls are laid out. So the option that doesn’t fit as a documentation method is risk assessment.