Generated access-review controls for the EHR need a named owner accountable for testing and remediation. Whom should the implementer assign as control owner?
Select an answer to reveal the explanation.
Short Explanation
Somebody’s name has to sit on that control—preferably the person who actually runs the app. Make the EHR application owner the control owner so tests and fixes have a clear home. Blank owners, faceless boards, and outside QSAs as instance owners leave accountability floating.
Full Explanation
Control ownership names who is accountable for operating, testing, and remediating a generated control on an entity. For hospital EHR access-review controls, assigning the EHR application owner as control owner aligns accountability with the person who understands access patterns, user populations, and remediation paths for that clinical system. Assigning an enterprise architecture review board with no individual accountable party fails by concept because collective ownership without a named owner routinely stalls tests and issue follow-through. Leaving the control owner blank so any GRC analyst can claim tests opportunistically fails by concept because opportunistic claim models create gaps, orphaned overdue work, and unclear remediation authority. Assigning an external QSA firm as production control owner inside the IRM instance fails by concept because external assessors review evidence; they are not typically the operating owners of internal application controls for day-to-day civic clinical compliance. Exam caveat: CIS-RC expects a named operational control owner on generated controls, distinct from examiner or board oversight roles. Operational check: open a generated EHR access-review control, set the EHR application owner as Control owner, and verify overdue notifications and issue assignment paths resolve to that owner rather than a blank or board-only field.