During a control review, a manager is recorded as accountable for ensuring a daily reconciliation control operates as designed, while a separate executive is accountable for the financial misstatement risk the control addresses. How should the risk practitioner describe these two distinct roles?
- ABoth individuals are control owners, since each one shares accountability for the operation of the daily reconciliation control
- BBoth individuals are risk owners, since each one is ultimately accountable for the financial misstatement exposure being managed
- CThe manager is the control owner accountable for the control operating, and the executive is the risk owner accountable for the residual risk Correct
- DThe executive is the control owner and the manager is the risk owner, reflecting the seniority of each person in the reporting line
Why A is wrong: Sharing the control label is tempting because both are involved, but the executive owns the risk outcome rather than the control mechanism, so the roles are not the same.
Why B is wrong: Calling both risk owners blurs the split, because the manager is accountable for running a control, not for accepting or treating the underlying exposure.
Why C is correct: Control ownership covers a control performing as designed, while risk ownership covers the residual exposure, so the two roles are correctly separated here.
Why D is wrong: Assigning roles by seniority feels intuitive, but ownership follows the responsibility held, so this reverses the two roles and misstates accountability.