Who is accountable for the process when an IT stakeholder operates a key control to address a risk scenario?

The risk owner is a designated individual or entity responsible for managing a specific risk, including ensuring that appropriate controls are in place, effective, and monitored. While an IT stakeholder may *operate* a control, the risk owner retains ultimate accountability for the risk and its management process.

An IT manager might be responsible for the IT operations, including the control's implementation, but accountability for the *risk itself* lies with the risk owner.

A system owner is responsible for a specific system, and may operate controls within that system, but the accountability for the broader risk associated with a scenario falls to the risk owner.

A data custodian is responsible for the care and management of data, which is distinct from the overall accountability for managing a risk scenario.