Exam CRISC topic 1 question 794 discussion

A. Risk owner The risk owner is responsible for overseeing the control environment and ensuring that the controls put in place to mitigate identified risks are effective. This includes monitoring the controls' performance, assessing their adequacy, and taking corrective actions if needed. While security monitoring operations and system owners play crucial roles in implementing and maintaining controls, the ultimate accountability for control effectiveness often rests with the risk owner, as they have a vested interest in managing the associated risks. Data owners, on the other hand, may be responsible for specific data-related controls but not necessarily the entire control environment.

Agree with A.

key word ' accountable'. The risk owner

Its Risk owner, this is first line of defence.

A: Correct answer Risk owner. The risk owner is accountable for the treatment and monitoring of the effectiveness of controls.

Is the control must be security related? I will go for A, risk owner.