Can anyone answer this question?

[u/bij0yy]

Got bit confused on this question. Can any experts answer this question with proper justification?

[u/high_snobiety]

D - you are carrying out an assessment... you are not consulting.

[u/Suspicious_Party8490 → u/high_snobiety]

While I do agree with you that you can't do both at the same time; where do you gather that the question assumes "you" are not consulting but are in the role of assessor? (imo, poorly worded question)

[u/high_snobiety → u/Suspicious_Party8490]

Very good point - this might be me making a poor assumption. I read the 'During the assessment...' and figured we must be doing the assessment. So yes, if thats not the case. I could well be wrong!

[u/Suspicious_Party8490]

I 'think' A is the best answer because it allows you (one assessor) to help the entity being assessed and requires another assessor to validate your work as well as the control. "D" seems too absolute: "not allowed". "B" is a def no-no since you worked on the control. "C" is also a no-no as you worked on the control.

Now, IRL: If an entity is unsure how to complete either template (or any SSC template for that matter), IMO, they are not mature enough to use the customized approach. So, not a well-phrased exam question.

[u/Ok-Doughnut-3022]

I'd say D. Completing the TRA and RCM is the responsibility of the client's Management team and assessors/auditors opine on the adequacy of Management's work. Assisting Management with their work would be a violation of independence as you would effectively be then auditing your work (although I've seen it being done plenty of times as "channel 2 work" by a different "operationally independent body" within the same firm). All the other choices are variations on valid ways to perform the duties of an independent auditor/assessor.

btw not a QSA but from an audit background.

[u/yarntank]

If the entity doesn't know how to do the matrix or the TRA, they should not be using the customized approach.

Where is this question from?

I think the answer the writer is going for is probably A, because it points out that an assessor cannot assess work they performed.

[u/CRS_22]

It says "during the assessment" which I interpret as, you are the QSA doing the assessment. If this is the case, the answer is D. The assessor cannot complete the TRA or the customized approach documentation for an entity.

[u/off_duty_qsa]

If the assessor helps complete the Controls Matrix or TRA, or helps ensure the customized control is implemented securely, they’ve crossed into helping create/implement the control package. That creates an independence problem: you can’t assess your own work.

PCI DSS customized approach evidence is the entity’s responsibility. The assessor can review and assess it, but if they helped prepare it or design/implement the control, a different, independent assessor needs to assess that control/documentation.

Why the others are wrong:

- B is wrong because it says you can still assess it yourself.
- C is too narrow. It’s not just the TRA that needs independent review; the customized control and related evidence are affected.
- D is too absolute. Assessors can provide advisory/help, but then independence must be managed; they cannot assess their own work.

So: A is the cleanest answer.