I responded by elaborating on the details about the process, e.g., identifying the scope of assets and compliance framework, defining the control objectives, defining the method for assessing the controls, conducting interviews, gathering and assessing control evidence documentation, tracking and reporting the results of the assessment to management.