Certified in Risk and Information Systems Control (CRISC) — Question 858

A large organization is replacing its enterprise resource planning (ERP) system and has decided not to deploy the payroll module of the new system. Instead, the current payroll system will continue to be used. Of the following, who should own the risk if the ERP and payroll systems fail to operate as expected?

Answer options

• A. The ERP administrator
• B. The business owner
• C. The project steering committee
• D. The IT project manager

Correct answer: B

Explanation

The business owner is ultimately responsible for the success of business operations and the associated risks, including those from the integration of the ERP and payroll systems. The ERP administrator, project steering committee, and IT project manager may oversee aspects of the systems, but the business owner holds accountability for the overall business impact if issues arise.