Question

During a risk response review, a newly appointed control owner for a data-loss-prevention (DLP) system tells the risk committee that because the control is operating effectively, the associated data-leakage risk is now fully 'owned and closed' by their team. The risk manager wants to correct the misunderstanding before it is documented in the risk register. Which statement best clarifies the accountability relationship the risk manager should communicate?

Accepted Answer

The control owner is accountable for the operating effectiveness of the DLP control, while the risk owner remains accountable for the residual data-leakage risk and its acceptance.

Answer

Once a control is operating effectively, accountability for the residual risk transfers entirely to the control owner who manages that control.

Answer

The risk owner is accountable for both the risk and the day-to-day operation of the control, so the control owner role is advisory only.

Answer

Because the risk is mitigated by an effective control, no residual risk remains and neither party retains ongoing accountability.