GRC Oversight
Glossary

Control owner

The named individual accountable for a control's operation and evidence: who an auditor or reviewer would ask if something looks wrong.

Every control needs a single accountable owner: the person responsible for the control actually operating as designed and for producing evidence when asked. Without a named owner, controls tend to decay silently between audits. Assigning ownership is one of the most basic things auditors check for.

Looking for another term or the full list?