Which of the following is the PRIMARY accountability for a control owner?

Communicating risk to senior management is typically the role of risk managers or leadership, not the primary function of a control owner.

Risk owners, not control owners, are accountable for the associated risk that the control is designed to mitigate.

A control owner is responsible for the day-to-day operation, maintenance, and effectiveness of a specific control, including monitoring its performance, addressing operational issues, and ensuring it continually meets its risk mitigation objectives.

While a control owner may be involved in identifying weaknesses, the primary accountability is effective operation; identifying and assessing weaknesses is often part of an audit or risk assessment function, or a collaborative effort.