Discretionary control is a decentralized method where someone makes decisions based on their own assessment rather than a formal centralized authority. Auditors should investigate who makes decisions and how, as this is often where control failures are found.