Topics in this domain
- Risk Response Options: Accept, Mitigate, Transfer, Avoid
- Aligning Responses with Appetite and Tolerance
- Cost-Benefit Analysis of Risk Responses
- Bias in Risk Decisions and Reporting
- Risk Owners and Control Owners
- RACI and Escalation
- Third-Party Risk Governance and Due Diligence
- Contracts, SLAs and the Right to Audit
- Monitoring Third Parties and Planning Exit
- Managing Issues, Findings and Control Deviations
- Risk Acceptance, Exceptions and Exemptions
- Control Frameworks and Their Purpose
- Control Types and Functions
- Designing and Selecting Controls
- Implementing Controls and Why Implementations Fail
- Control Design versus Operating Effectiveness
- Control Testing: Objectives, Evidence and Frequency
- Building and Tracking Risk Action Plans
- Collecting and Aggregating Risk Data
- Validating Risk Data Quality
- KRIs, KPIs and KCIs
- Thresholds, Escalation Triggers and Appetite
- Metric Pitfalls and Misuse
- Continuous Monitoring versus Periodic Assessment
- Tailoring Risk Reports to the Audience
- Heat Maps, Dashboards and Scorecards
- Identifying and Assessing Emerging Risks
- Integrating Emerging Risk into Decisions
Risk Owners and Control Owners
Two kinds of ownership
Many-to-many
| Risk (owner) | Controls (owners) |
|---|---|
| Payment fraud (CFO) | Dual approval (finance), MFA (IAM team), monitoring (SOC) |
| Customer data breach (head of sales) | Encryption (infrastructure), DLP (security), access reviews (sales managers) |
One risk may rely on several controls with different owners, and one control may support several risks.
Working together
- The control owner detects a failure.
- They report it to the risk owner.
- The practitioner reassesses the risk.
- The risk owner decides on the response.
Example. Quarterly access reviews for the payments system were skipped twice. The IAM team (control owner) told the CFO (risk owner), the practitioner re-rated fraud risk from medium to high, and the CFO approved temporary extra monitoring.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who is accountable for a control operating | The control owner |
| Who decides when a control fails | The risk owner |
| Can one person be both | Yes, but they’re often different people |
| BEST way to clarify ownership | Map risks to controls and named owners |
In short
- The risk owner is accountable for the risk outcome; the control owner is accountable for a control operating effectively.
- Risk owners are usually business managers; control owners are often in IT, security or operations.
- One risk may rely on several controls with different owners; one control may support several risks.
- Control owners report control failures to risk owners, who decide on the response.
- Mapping risks to controls and owners shows who must act when something changes.
Exam traps
- Assuming the control owner also owns the risk.
- Making IT the risk owner because IT runs the controls.
- Control failures reported only within IT, never reaching the risk owner.
- Controls with no named owner.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Two kinds of ownership
1 / 7