CRISC · Question #213
Who is MOST appropriate to be assigned ownership of a control
The correct answer is D. The individual accountable for monitoring control effectiveness. The individual most appropriate for control ownership is the one who bears ultimate accountability for the control's sustained effectiveness and performance.
Question
Who is MOST appropriate to be assigned ownership of a control
Options
- AThe individual responsible for control operation
- BThe individual informed of the control effectiveness
- CThe individual responsible for resting the control
- DThe individual accountable for monitoring control effectiveness
How the community answered
(43 responses)- A2% (1)
- B5% (2)
- C2% (1)
- D91% (39)
Why each option
The individual most appropriate for control ownership is the one who bears ultimate accountability for the control's sustained effectiveness and performance.
The individual responsible for control operation executes the control, but ownership implies broader accountability for its overall success and not just its execution.
Being informed of control effectiveness is part of management oversight but does not encompass the full accountability inherent in control ownership.
The individual responsible for testing the control performs an assurance function, which is distinct from the ongoing, direct accountability of control ownership.
The control owner is fundamentally accountable for the control's design, proper implementation, and its continuous effectiveness in mitigating the identified risk, which inherently includes monitoring its performance. This accountability ensures that the control actively achieves its intended purpose over time.
Concept tested: Control ownership responsibilities
Source: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
Topics
Community Discussion
No community discussion yet for this question.