An information security audit identified a risk resulting from the failure of an automated control Who is responsible for ensuring the risk register is updated accordingly?

The risk practitioner facilitates risk management processes but the direct accountability for the control's performance and associated risk update rests with the control owner.

The risk owner is responsible for the overall risk, but the *control owner* is specifically accountable for reporting issues with the control, which then informs the risk owner and drives the register update.

The control owner is accountable for the ongoing design and operational effectiveness of their assigned controls. If an audit reveals a control failure, it directly impacts the residual risk that the control was intended to mitigate, making the control owner responsible for ensuring the risk register is accurately updated to reflect this change in risk exposure.

The audit manager identifies and reports findings, but their role is assurance, not the ongoing management or updating of the organization's risk register.