CRISC · Question #411
Who should be responsible for approving the cost of controls to be implemented for mitigating risk?
The correct answer is B. Risk owner. The risk owner is ultimately responsible for the risk, including approving the resources and costs associated with mitigating it.
Question
Who should be responsible for approving the cost of controls to be implemented for mitigating risk?
Options
- ARisk practitioner
- BRisk owner
- CControl owner
- DControl implementer
How the community answered
(22 responses)- A9% (2)
- B86% (19)
- C5% (1)
Why each option
The risk owner is ultimately responsible for the risk, including approving the resources and costs associated with mitigating it.
The risk practitioner advises on risk but does not typically have the authority to approve control costs.
The risk owner is the individual or entity with accountability for a specific risk and its potential impact, and thus has the authority to approve the financial commitments for risk treatment. They are best positioned to weigh the cost of controls against the potential impact of the risk to their assets or operations.
A control owner is responsible for the specific control, not the overarching decision to fund its implementation.
A control implementer is responsible for installing or configuring the control, not approving its cost.
Concept tested: Risk ownership and control approval
Topics
Community Discussion
No community discussion yet for this question.