The best recommendation to the control owner when an existing control has deteriorated over time is to discuss risk mitigation options with the risk owner. This is because the risk owner is the person or entity who has the authority and accountability to make decisions and take actions regarding the risk, including the selection and implementation of the risk response strategies. The control owner is the person or entity who is responsible for the design, operation, and maintenance of the control, but not for the overall risk management. By discussing risk mitigation options with the risk owner, the control owner can communicate the current status and performance of the control, and collaborate on finding the most appropriate and effective solution to address the risk and the control deterioration. The other options are not the best recommendation to the control owner, because they do not involve the risk owner, who is the key stakeholder in the risk management process, as explained below:
A. Implement compensating controls to reduce residual risk is not the best recommendation, because it may not be feasible, efficient, or sufficient to address the risk and the control deterioration. Compensating controls are additional or alternative controls that are implemented to mitigate the risk when the primary control is not available, adequate, or effective. However, implementing compensating controls without discussing with the risk owner may result in wasting resources, duplicating efforts, or conflicting objectives, and may not align with the risk appetite or strategy of the organization.
B. Escalate the issue to senior management is not the best recommendation, because it may not be necessary, timely, or appropriate to involve senior management in the risk and control deterioration issue. Senior management is the highest level of authority and oversight in the organization, and may not have the detailed or operational knowledge or involvement in the risk and control management. Escalating the issue to senior management without discussing with the risk owner may create confusion, delay, or misunderstanding, and may not result in the optimal risk mitigation solution.
D. Certify the control after documenting the concern is not the best recommendation, because it may not be accurate, honest, or compliant to certify the control when it has deteriorated over time. Certifying the control is the process of attesting that the control is designed and operating effectively and efficiently, and meets the established criteria and standards. Certifying the control after documenting the concern may not reflect the true status and performance of the control, and may not comply with the internal or external audit or regulatory requirements. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.2.1, page 115. Roles and Responsibilities in Risk Management, Risk Owner vs. Control Owner: What’s the Difference?, Control Deterioration: How to Avoid It and What to Do About It
