An organisation distinguishes between the owner of a risk and the owner of the controls that mitigate it. A new committee member asks what the control owner is primarily accountable for, as distinct from the risk owner. Which statement best describes the control owner's accountability?
- AEnsuring the assigned mitigating controls remain designed and operating effectively so the risk stays at its intended level Correct
- BDeciding whether the residual risk that remains after treatment falls within the organisation's approved risk appetite
- CDetermining the inherent risk rating before any controls are applied to the affected business process
- DSetting the organisation's overall risk appetite and tolerance thresholds that govern how much residual risk is acceptable
Why A is correct: Correct because the control owner is accountable for the ongoing design and operating effectiveness of the specific controls that hold the risk at its planned residual level.
Why B is wrong: Tempting because it is a core ownership duty, but accepting residual risk against appetite is the risk owner's accountability, not the control owner's.
Why C is wrong: Tempting because rating sounds like an ownership task, but assessing inherent risk is part of the risk assessment process, not the control owner's standing accountability.
Why D is wrong: Tempting because it concerns risk levels, but appetite and tolerance are set by the board and senior management, far above the control owner's remit.