Role of the System Owner:
The system owner is responsible for the overall operation and management of an application or system. This includes ensuring that technical controls are implemented and functioning as intended.
They have detailed knowledge of the system's architecture, the controls in place, and how those controls are applied within the system.
Effectiveness of Technical Controls:
Assessing the effectiveness of a technical control requires understanding its implementation, configuration, and operational context.
The system owner is best positioned to provide this information as they manage and oversee the technical environment of the application.
Comparing Other Roles:
Internal Auditor:While auditors review and evaluate the effectiveness of controls, they do so from an independent standpoint and might not have detailed, day-to-day operational insights.
Process Owner:The process owner focuses on business processes rather than technical controls specific to an application.
Risk Owner:The risk owner is responsible for managing risk but may not have the technical expertise or detailed operational knowledge of the system.
Supporting Information:
According to the CRISC Review Manual, the system owner is often involved in the assessment and reporting of control effectiveness, especially regarding technical controls (CRISC Review Manual, Chapter 3: Risk Response and Mitigation, Section 3.1.3 Assessing Control Effectiveness) .

Penetration test results are the most helpful resource to a risk practitioner when updating the likelihood rating in the risk register. Penetration testing is a method of simulating real-world attacks on an IT system or network to identify and exploit vulnerabilities and measure the potential impact. Penetration test results provide empirical evidence of the existence and severity of vulnerabilities, as well as the ease and probability of exploitation. These results can help the risk practitioner to update the likelihood rating of the risks associated with the vulnerabilities, and to prioritize the risk response actions. Risk control assessment, audit reports with risk ratings, and business impact analysis (BIA) are also useful resources for risk management, but they are not as directly related to the likelihood rating as penetration test results. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.3.3, page 2-28.

Control Self-Assessments (CSAs)provide an efficient way for process owners and staff to assess control effectiveness continuously. ISACA recognizes CSAs as a proactive approach that encourages accountability and early detection of control weaknesses, reducing the need for frequent external testing.

Anonymizing personal data in non-production environments means replacing the real data with fictitious but realistic data that does not allow identification of the individuals. This is a good way to mitigate the risk of sensitive personal data leakage from a software development environment, as it reduces the exposure of the data to unauthorized access or misuse. Tokenizing personal data only in test environments is not sufficient, as the data may still be exposed in other non-production environments, such as development or staging. Data loss prevention tools (DLP) installed in passive mode may detect and report data leakage incidents, but they do not prevent them from happening. Multi-factor authentication for access to non-production environments may enhance the security of the access, but it does not protect the data from being leaked by authorized users or compromised by other means. References = CRISC Review Manual (Digital Version), page 226; CRISC Review Questions, Answers & Explanations Database, question 195.

The best course of action for the risk practitioner is to follow the incident reporting procedures established by the organization. This will ensure that the incident is properly documented, escalated, and resolved in a timely and consistent manner. Reporting the incident to the chief risk officer, advising the employee to forward the email to the phishing team, or advising the employee to permanently delete the email are not the best courses of action, as they may not comply with the organization's policies and standards, and may not address the root cause and impact of the incident. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 4, Section 4.2.2.1, page 193.