The risk register lists an IT database administrator as both the owner of the risk 'loss of customer order data' and the owner of the backup control that treats it. What change should the information security manager recommend?
Select an answer to reveal the explanation.
Short Explanation
Think about it: you know the person who bakes the cake isn't necessarily the one who decides whether it's worth the risk of burning it. The business owns the risk of losing order data; IT can own the backup control that protects it. The trap is lumping both jobs on one technical person.
Full Explanation
Risk ownership and control ownership are different roles. The risk owner is accountable for a business risk and has the authority to decide how it is treated, including accepting residual risk and funding controls; for loss of customer order data, that is the business owner of the ordering process, who understands and bears the business impact. The control owner is responsible for ensuring a specific control, here the backup, is designed and operating effectively, which fits the database administrator. Separating the roles provides accountability and a natural check, since the risk owner can challenge whether the control is sufficient. Moving backup control ownership to internal audit would compromise audit's independence, and the administrator would still wrongly own a business risk. Adding security approval of backup changes keeps the misassigned risk ownership in place and adds an operational step that does not address accountability. Making the security manager the risk owner repeats the same error, giving a business risk to a function that advises on risk but does not own the process or its outcomes. Exam caveat: one person may own several controls, but business risk should sit with business management. Operational check: confirm the register shows a business risk owner and a separate control owner, each acknowledged.