Most security managers stick to their established roles and let the auditors handle the control testing.
In keeping with their role as advisors and facilitators, most of the security managers said that they relied significantly on auditors to test controls.