When mitigation is the chosen risk treatment, which of the following roles is responsible for effective implementation of the chosen treatment?

The correct answer is B. Control owner. The control owner is the individual accountable for implementing and managing specific controls that mitigate risks. While the risk owner is responsible for the overall risk and decision-making, it is the control owner who ensures the selected mitigation is effectively…

Submitted by katya_ua· Apr 18, 2026Information Security Risk Management

Question

Options

ARisk owner
BControl owner
CBusiness system owner
DApplication owner

How the community answered

(16 responses)

A
6% (1)
B
88% (14)
C
6% (1)

Explanation

The control owner is the individual accountable for implementing and managing specific controls that mitigate risks. While the risk owner is responsible for the overall risk and decision-making, it is the control owner who ensures the selected mitigation is effectively implemented and "The control owner is responsible for ensuring that the control is properly designed, implemented, and operating effectively."

Topics

#Risk Management Roles#Control Ownership#Risk Treatment#Roles and Responsibilities

Community Discussion

No community discussion yet for this question.

Full CISM Practice