Exam CRISC topic 1 question 1343 discussion

Straight from the CRISC book "a control should be owned by the owner of the risk that it mitigates. However, the control may be owned by someone else in the case of controls that affect more than one risk."

Something is missing in this question. RIsk owner is a person not a department/business unit. Also risk owner should be a senior person not a staff member.. so all of the options other than C are a concern.

Have to go with D. Needs to be assigned to an individual, and control owner and risk owner do not need to be the same person.

To ensure accountability, the risk owner must be an individual, not a department or organization.

A. The risk owner is a staff member rather than a department manager. The greatest concern would be when the risk owner is a staff member rather than a department manager. Risk owners should typically be individuals with the appropriate level of authority and decision-making power to manage and address the risks effectively. Department managers or higher-level management personnel are better positioned to allocate resources, drive risk mitigation efforts, and ensure cross-functional collaboration when needed.

It is D. as per your first choice.

Correction, reason: When the risk owner is not the control owner for associated data controls, it can lead to a lack of coordination and accountability in managing the risk. This is because the risk owner is responsible for identifying and managing risks, while the control owner is responsible for implementing and maintaining controls to mitigate those risks. If the risk owner and control owner are not the same person, it can be difficult to ensure that the controls are appropriate and effective in mitigating the identified risks, and that there is accountability for their implementation and effectiveness. In summary, while the risk owner does not necessarily have to be the owner of the control, it is important to ensure that there is coordination and accountability between the two roles to effectively manage and mitigate risks.

To ensure accountability, the risk owner must be an individual, not a department or organization. On the other hand, the owner of the risk need not necessarily be the owner of the control and that it is not is not a concern.