The organization's process owner should own the risk of exposing the payroll data due to a control weakness at the third party, because the process owner is the person who is responsible for the business process that generates, uses, or transfers the payroll data. The process owner should also ensure that the third party complies with the contractual obligations and service level agreements that define the expected performance and security standards of the payroll data processing. The other options are not the correct answers, because they are not the primary owners of the risk, although they may also be involved in the risk management process. The third party's IT operations manager, the third party's chief risk officer (CRO), and the organization's risk practitioner are examples of secondary owners or stakeholders of the risk, who may provide support, guidance, or oversight to the risk owner, but they are not accountable for the risk or the risk response strategy. References = CRISC: Certified in Risk & Information Systems Control Sample Questions

Key performance indicators (KPIs) are metrics or measures that provide information on the progress and performance of an organization or a team toward an intended result or objective. KPIs can help to monitor and evaluate the achievement of strategic, operational, or tactical goals, and to support the decision making and improvement of the organization or the team1.
Key control indicators (KCIs) are metrics or measures that provide information on the status and effectiveness of the controls or safeguards that are implemented to manage the risks or threats that an organization or a team faces. KCIs can help to identify and assess the strengths and weaknesses of the controls or safeguards, and to ensure the compliance and accountability of the organization or the team2.
The statement that best illustrates the relationship between KPIs and KCIs is that KPIs and KCIs both contribute to understanding of control effectiveness, because they can help to:
* Measure and compare the actual and expected outcomes and impacts of the controls or safeguards, and to determine the gaps or deviations
* Analyze and understand the causes and consequences of the gaps or deviations, and to identify the root problems or issues
* Evaluate and report the performance and compliance of the controls or safeguards, and to communicate the results and feedback to the stakeholders
* Improve and optimize the design and implementation of the controls or safeguards, and to enhance the efficiency and effectiveness of the risk management process34 The other statements do not illustrate the relationship between KPIs and KCIs accurately, but rather some of the differences or misconceptions between them. KPIs measure manual controls, while KCIs measure automated controls is a difference between KPIs and KCIs, but not a general one. KPIs and KCIs can measure both manual and automated controls, depending on the type and nature of the controls or safeguards. A robust KCI program will replace the need to measure KPIs is a misconception about KPIs and KCIs, as they are not mutually exclusive or substitutable. KPIs and KCIs complement and support each other, as they provide different but related information on the performance and risk management of the organization or the team.
KCIs are applied at the operational level while KPIs are at the strategic level is a difference between KPIs and KCIs, but not a universal one. KPIs and KCIs can be applied at different levels of the organization or the team, depending on the scope and purpose of the measurement and evaluation. References =
* Key Performance Indicator (KPI): Definition, Types, and Examples
* Key Control Indicators - ISACA
* Key Control Indicators: What They Are and How to Use Them
* Key Performance Indicators vs. Key Control Indicators: What's the Difference?
* [CRISC Review Manual, 7th Edition]

Section: Volume D
Explanation/Reference: