Control Owner

Controls fail most often when everyone assumes someone else is looking after them. Naming an owner removes that doubt. The owner does not need to perform every step personally. Staff may run the control day to day, but the owner answers for it, signs off periodic self-assessments, supplies evidence to auditors and drives any fixes. Owners normally sit in the first line, close to the activity. A control owner is closely related to a risk owner, who is accountable for a risk as a whole and may rely on several controls to keep it in range. In practice one manager can hold both roles for a small process, while larger risks have a senior risk owner and several control owners underneath. Owners are recorded in the risk and control matrix. A name beside each control gives auditors someone to ask and gives failures someone to answer for them.

At a bank, a monthly control reconciles the general ledger with the payments system, and the financial controller is its named owner. When the reconciliation is two weeks late, internal audit asks her, not the junior analyst who prepares it, for an explanation, and she presents a plan to restore the schedule.