Who should be responsible (of evaluating the residual risk after a compensating control has been

A compliance manager focuses on adherence to regulations and policies, not typically the detailed technical evaluation of residual risk post-control implementation.

The risk owner is ultimately accountable for the risk but delegates the detailed assessment and evaluation of controls and residual risk to the risk practitioner.

The control owner is responsible for the operation and effectiveness of a specific control but may not have the broader context or responsibility to evaluate the overall residual risk from a risk management perspective.

A risk practitioner's role involves identifying, assessing, and monitoring risks, including the evaluation of residual risk after the implementation of controls. They have the technical expertise and a holistic view to assess how effectively the compensating control has reduced the initial risk and what level of risk remains.