You are an information system auditor of HDA Inc. You are auditing and evaluating the effectiveness of the control self-assessment (CSA) program in place. In terms of importance, which one of the following options is crucial for an effective CSA program?