Who is BEST suited to provide information to the risk practitioner about the effectiveness of a technical control associated with an application?

The system owner has direct responsibility for the development, maintenance, and operational aspects of a specific system or application, giving them intimate knowledge of its deployed technical controls and their actual performance. They can provide first-hand, detailed insights into how these controls function in practice and their effectiveness against identified risks.

An internal auditor provides independent assurance on controls but does not typically have direct operational insight into their day-to-day effectiveness.

A process owner is responsible for the overall business process, which might utilize an application, but they may not have deep technical knowledge of the application's specific controls.

A risk owner is responsible for managing a particular risk but may not have the granular technical details of the controls implemented within a specific application.