DeltaFin wants to develop a control scoring method for its RCSA program.

Statement I:DeltaFin can develop a control scoring method that assesses both the design and the performance of the control.

Verified and correct. It is essential to assess both design and performance to ensure that controls are not only well-designed but also effectively implemented.

Statement II:DeltaFin can combine the design and performance scores for each control to produce an overall control effectiveness score.

Verified and correct. Combining both scores provides a comprehensive measure of control effectiveness.

Statement III:DeltaFin can use the control performance scores to compute an overall risk severity score.

This is not accurate as the risk severity score typically considers the inherent risk and the residual risk after considering the controls, not just the performance scores.

Statement IV:DeltaFin can determine its own appropriate control scoring method.

Verified and correct. Organizations have the flexibility to develop their own scoring methods that best fit their operational risk profiles and needs.