The correct answer is B . Payroll is a business process owned by HR, so the HR executive is the most appropriate risk owner. Outsourcing the application to a cloud software provider does not transfer business accountability for payroll risk. The uploaded CRISC notes state that ownership is best established by mapping identified risk to a specific business process. They also emphasize assignment of risk owners and accountability as critical to risk management.
The IT executive may manage technology controls, vendor management may oversee the contract, and the cloud provider may operate provider-side controls, but the business risk owner remains the HR executive.
===========
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit