During operating-model design, a municipal CIO asks who should own residual scores versus who should configure the IRM risk application. Which separation is correct?

Operating-model design for municipal IRM separates accountability from platform configuration: business or process risk owners accept and treat risks, while GRC administrators configure frameworks, methodologies, workflows, and roles. Residual score ownership must sit with leaders who can fund and execute treatment for civic services; administrators enable the machinery without becoming the named owner of every high residual. That persona split keeps the risk register actionable and prevents the GRC platform team from absorbing business accountability by configuration convenience.

Making GRC administrators named risk owners for every high residual so scores never stall conflates configuration capacity with operational ownership and creates false accountability. Letting platform administrators approve all appetite breaches because they control ACLs mistakes technical privilege for risk-acceptance authority. Having Internal Audit own day-to-day residual scoring for operational technology risks collapses the third line into first-line scoring and undermines independence.

Exam caveat: CIS-RC persona questions test whether you assign accept/treat to risk owners and frameworks/workflows/roles to GRC admins. Access control administrators are not automatic appetite approvers; auditors are not default OT residual owners.

Operational check: review role mapping for a sample OT or service risk; confirm the named risk owner is a business or process lead; confirm GRC admin roles can configure methodology but are not listed as residual owners; verify appetite-breach approvals route to designated executives, not solely to platform ACL admins.