The correct answer is A because independent audits provide objective assurance that existing controls meet compliance requirements. Independent auditors can evaluate whether controls are appropriately designed, implemented, documented, and operating effectively against regulatory, contractual, or policy requirements.
Establishing compliance metrics is useful for monitoring trends and reporting status, but metrics may not provide sufficient independent validation. Reviewing security policies confirms whether requirements are documented, but it does not prove that controls are operating effectively. Performing risk assessments helps identify and evaluate risk, but risk assessment is not the same as compliance assurance. In CISM governance, independent assurance is important because management needs reliable evidence that controls are effective and obligations are being met. Audits also help identify gaps, exceptions, and remediation needs. Because compliance requires evidence and objective evaluation, independent audits provide the greatest assurance among the listed options.
Reference: CISM Information Security Governance; independent assurance, compliance audits, control effectiveness, and governance oversight principles.