During operating-model design, a municipal CIO asks who should own residual scores versus who should configure the IRM risk application. Which separation is correct?
Select an answer to reveal the explanation.
Short Explanation
Owners live with the risk the way a fleet manager lives with the buses; admins build the garage tools. Risk owners accept and treat. GRC admins configure the IRM machinery—frameworks, workflows, roles—without becoming the named owner of every residual.
Full Explanation
Persona architecture in IRM separates accountability from platform configuration. Risk owners (typically business or process leaders) own assessment outcomes and responses, while GRC administrators maintain frameworks, methodologies, and access. Collapsing admin, audit, or platform roles into day-to-day risk ownership weakens accountability and blurs lines of defense.