The RACI chart for a new cloud platform lists several teams as responsible for quarterly user access reviews, but no one is marked as accountable. What is the BEST action?
Select an answer to reveal the explanation.
Short Explanation
When everybody's responsible and nobody's accountable, guess what happens: nothing gets done. Every activity needs exactly one owner you can hold to the result, and management assigns it. Watch for the 'shared accountability' answer; two accountable owners is just a fancier way of having none.
Full Explanation
In a RACI model, several parties may be responsible for doing the work, but exactly one should be accountable for ensuring it is done and for answering for the outcome. Without an accountable owner, access reviews may be partially performed, inconsistently evidenced or skipped, and no one is positioned to escalate problems. The best action is for management to assign a single accountable owner, typically the business or system owner for the platform, who can be held to the result. Making the information security team accountable for reviews across all cloud systems shifts business ownership of access to a support function; security can facilitate and monitor reviews, but access decisions belong to those who own the system and its data. Joint accountability between project and operations managers recreates the ambiguity in a different form, because each can assume the other is ensuring completion. Recording the gap as an accepted risk until production misuses risk acceptance for a governance defect that can be corrected immediately and ignores that access may already exist in preproduction. Exam caveat: accountability can sit at a senior level while responsibility is delegated. Operational check: confirm the revised RACI shows one accountable role and that the first quarterly review is evidenced and signed off by that owner.