An organization’s management has asked the chief audit executive to help the HR team facilitate...

A risk and control self-assessment is appropriate because it enables management and relevant employees to participate directly in identifying risks, control gaps, and corrective actions associated with succession planning. Internal audit can facilitate the process without assuming management responsibility, helping participants evaluate whether current controls adequately address risks such as loss of critical knowledge, inadequate leadership continuity, or insufficient talent pipelines. Training may increase awareness but does not itself provide a structured assessment of risks and controls. Process mapping documents workflow and responsibilities but is not primarily designed to identify and prioritize corrective actions. A performance audit is an assurance activity and would be less collaborative than the requested facilitation. Therefore, a risk and control self-assessment best meets management’s objective while preserving ownership of corrective actions within HR and management.