A segregation of duties control was found to be ineffective because it did not account for all applicable functions when evaluating access. Who is responsible for ensuring the control is designed to…

The risk manager oversees the entire risk management process, including identifying, assessing, and treating risks, but typically delegates ownership of specific controls.

The control owner is the individual or team accountable for the design, implementation, operation, and effectiveness of a specific control. They are responsible for ensuring that the control adequately mitigates the identified risks and is appropriately designed to cover all relevant functions.

The control tester assesses whether the control is operating effectively, but they are not primarily responsible for its initial design.

The risk owner is accountable for managing a specific risk and ensuring that appropriate controls are in place, but the control owner is specifically responsible for the control's design and effectiveness.