Certified in Risk and Information Systems Control (CRISC) — Question 1377

Who should be accountable for monitoring the control environment to ensure controls are effective?

Answer options

• A. Risk owner
• B. Security monitoring operations
• C. Impacted data owner
• D. System owner

Correct answer: A

Explanation

The risk owner is the individual who holds accountability for the effectiveness of controls in the control environment, as they have the most insight into the risks involved. The other options, while involved in various aspects of security, do not carry the same level of accountability for monitoring the overall control effectiveness.