The head of IT insists on owning the risk for the company's claims-processing application because IT built and runs it. The claims department relies on the application for its core business process. Who should own this risk?
Select an answer to reveal the explanation.
Short Explanation
Whoever loses the most when the claims process stops is the one who should own the risk, and that's the claims business, not the team that built the system. IT can own controls and operations. The trap you'll see is assuming that whoever runs the tech owns the business risk.
Full Explanation
Risk ownership follows business accountability. The claims department depends on the application for its core process, so the impact of a compromise or outage falls on claims operations, customers and the organization's obligations in that area. The business owner of the claims process is therefore best placed to judge the acceptable level of risk, to prioritize treatment against business needs and to accept residual risk. IT builds and operates the application and can own technical controls and service delivery, but owning a business risk would let the provider of a service decide how much risk the consumer of that service bears. The information security manager advises on risk, facilitates assessment and reports to management, but owning the risk would place a business decision with a function that does not control the process or its budget. The lead developer is responsible for building the application securely, a control responsibility, and has neither the authority nor the business perspective to accept risk for the claims operation. Exam caveat: if a risk lies purely in shared IT infrastructure with no single business owner, IT management may own it, but that is not this scenario. Operational check: confirm the register names the claims process owner as risk owner and records the IT controls with their own control owners.