During a risk assessment, a risk practitioner learns that an IT risk factor is adequately mitigated by compensating controls in an associated business process. Which of the following would enable…

Compensating controls are critical for mitigating risk when primary controls are insufficient or absent. Regularly reviewing their effectiveness ensures that these controls continue to perform as intended, remain appropriate for the evolving threat landscape, and adequately address the identified risk, thereby sustaining effective residual risk management.

Reporting the use of compensating controls to senior management is a governance activity but does not actively manage the ongoing effectiveness of the controls.

Recommending additional IT controls might reduce residual risk further but doesn't specifically address the ongoing management and validation of existing compensating controls.

Requesting reassigning ownership to IT might centralize responsibility but doesn't inherently ensure the continued effectiveness and regular validation of the compensating controls themselves.