Who should own monthly control attestations for the city’s permitting system under a normal lines-of-defense model?
Select an answer to reveal the explanation.
Short Explanation
Monthly attestations belong to the people who run the control—the control owner—not the referee. Internal audit may test later; they should not be the default first-line checkbox owners. Keep the lines of defense from collapsing into one overloaded audit team.
Full Explanation
Under a normal lines-of-defense model, monthly control attestations for the city’s permitting system belong to the control owner persona—not the internal auditor—as first-line ownership. Operators who run the control affirm operating effectiveness; auditors may test independently later. Collapsing attestation ownership into audit destroys independence and overloads the third line with first-line chores. Only the external financial statement auditor as the first-line operator confuses external assurance with day-to-day control operation. Making the internal audit manager the routine first-line attestation owner likewise blurs independence. Assigning the network monitoring tool with no human control owner removes accountability for attestation. Exam caveat: control owners attest; auditors assure—do not swap those jerseys on persona items. Operational check for permitting: name the application or process control owner in the IRM control record, schedule monthly attestation to that persona, and keep audit engagement procedures off the standing attestation assignment list. In civic IRM programs, document the decision, name owners, and verify the platform records match the intended operating model before expanding scope. Re-check after organizational or CMDB changes so evidence remains defensible.