A person in whom the enterprise has invested the authority and accountability for making control-related decisions and for ensuring the control is implemented and operating effectively is called what?

• A. Control risk self-assessment
• B. Control owner
• C. Business impact
• D. Frequency analysis

Answer: (B)

The person who is given both the authority to decide on how a control is run and the accountability to ensure that control is properly designed, implemented, and operating effectively is the control owner. This role carries overall responsibility for the control’s existence, performance, and ongoing integrity, including making decisions about changes and ensuring it remains effective over time.

This fits because the description focuses on ownership and accountability for a control, not on processes or metrics. Control risk self-assessment is a method for evaluating controls, not a person who owns a control. Business impact refers to the consequences from a risk, not who is responsible for a control. Frequency analysis is a technique to analyze how often events occur, not who owns the control.