Who should own monthly control attestations for the city’s permitting system under a normal lines-of-defense model?
Select an answer to reveal the explanation.
Short Explanation
Monthly attestations belong to the people who run the control—the control owner—not the referee. Internal audit may test later; they should not be the default first-line checkbox owners. Keep the lines of defense from collapsing into one overloaded audit team.
Full Explanation
In IRM persona design, control owners (first line) complete routine attestations for their systems, while internal audit provides independent assurance. Assigning auditors as standing first-line attestation owners blurs independence and overloads audit. Implementation planning should map attestation ownership to the control owner persona for applications such as permitting.