Providing encrypted access to organizational assets is the best method to mitigate the risk of inadvertent data leakage by remote workers. Encryption ensures that data remains secure, even if accessed over unsecured networks.

Risk owner approval ensures accountability and alignment of the changes with the enterprise's risk management strategy. It reflects adherence to the principles ofRisk Ownership and Governance, critical for maintaining control over mitigation activities.

The acceptance of control costs that exceed risk exposure most likely demonstrates corporate culture misalignment, as it indicates that the organization is not following the principles and values of effective risk management, and that there is a lack of communication and coordination among the risk owners and stakeholders. Corporate culture misalignment can also result in inefficient and wasteful use of resources, and reduced risk-return trade-off. The organization should align its corporate culture with its risk appetite and tolerance, and ensure that the control costs are proportional and justified by the risk exposure and the expected benefits. References = Most Asked CRISC Exam Questions and Answers. CRISC: Certified in Risk & Information Systems Control Sample Questions, Question 255. ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, Question 255. CRISC by Isaca Actual Free Exam Q&As, Question 9.

Role of the System Owner:
The system owner is responsible for the overall operation and management of an application or system. This includes ensuring that technical controls are implemented and functioning as intended.
They have detailed knowledge of the system's architecture, the controls in place, and how those controls are applied within the system.
Effectiveness of Technical Controls:
Assessing the effectiveness of a technical control requires understanding its implementation, configuration, and operational context.
The system owner is best positioned to provide this information as they manage and oversee the technical environment of the application.
Comparing Other Roles:
Internal Auditor:While auditors review and evaluate the effectiveness of controls, they do so from an independent standpoint and might not have detailed, day-to-day operational insights.
Process Owner:The process owner focuses on business processes rather than technical controls specific to an application.
Risk Owner:The risk owner is responsible for managing risk but may not have the technical expertise or detailed operational knowledge of the system.
Supporting Information:
According to the CRISC Review Manual, the system owner is often involved in the assessment and reporting of control effectiveness, especially regarding technical controls (CRISC Review Manual, Chapter 3: Risk Response and Mitigation, Section 3.1.3 Assessing Control Effectiveness) .