A centrally run quarterly access-review control covers applications used by three business units. An audit finds that no reviews were completed for two quarters, and each unit's manager states that another unit or IT was responsible. What should the information security manager do to BEST prevent a recurrence?
Select an answer to reveal the explanation.
Short Explanation
When three of you share a dog and nobody's named as the one who feeds it, guess what happens? Nobody feeds it. A shared control needs one accountable owner with everyone else's supporting duties written down, and the trap is the security team grabbing the leash itself.
Full Explanation
A control that serves several business units fails predictably when accountability is spread across all of them, because each party assumes another is performing it. The durable fix is to have senior management, which holds authority over the units, designate a single accountable control owner and document the supporting responsibilities of each participating unit, typically in a RACI-style assignment. That gives the control a person who answers for its operation and a clear basis for monitoring. Having the security team run the reviews itself removes the symptom but places operational ownership with the function that should be advising and overseeing, and it leaves the business units without accountability for access to their own applications. Seeking disciplinary action addresses blame for the past rather than the structural gap that caused it, and it does not establish who owns the control going forward. Recording the control as ineffective and waiting for the next audit cycle documents the problem but leaves the exposure untreated for another year. Exam caveat: the information security manager facilitates and recommends ownership; the assignment carries weight because management makes it. Operational check: confirm the control appears in the register with one named owner, documented unit duties, and evidence of the next quarterly review.