Control ownership rotates so often that sufficiency reviews never stick to a responsible person. What monitoring foundation is missing?
Select an answer to reveal the explanation.
Short Explanation
If everyone briefly “owns” the control, nobody really does. Reviews die in the handoff pile. Pick a lasting owner—or a clean succession—so sufficiency checks actually happen.
Full Explanation
Effective monitoring depends on accountable ownership over time. When control ownership rotates so often that sufficiency reviews never stick to a responsible person, the missing foundation is clear ongoing owners so reviews remain assigned and completed. Municipal programs cannot sustain continuous improvement on orphaned controls and revolving accountability.
Claiming frequent ownership rotation strengthens monitoring by spreading blame evenly confuses diffusion with resilience. Asserting sufficiency reviews need no owner if a shared inbox receives the calendar invite substitutes an unowned mailbox for accountable completion. Believing controls monitor themselves once installed so named owners are optional abandons human governance of physical and procedural safeguards.
Exam caveat: ownership continuity enables monitoring continuity. Rotation without handoff is a program defect.
Operational check: assign durable control owners with documented deputies; require handoff notes on role change; track overdue sufficiency reviews by owner; escalate unowned controls to the risk or safety lead until assignment is fixed. Enforce owner assignment as a precondition for control records to remain “active” in the monitoring system. Auto-flag controls with vacant owners for risk-lead reassignment within a set number of days.