Knowledge area
Risk and governance
Control owners, exceptions, evidence and review cycles.
Every control needs an owner and evidence
Define the risk, target setting, accountable owner and verification method. Deviations require a risk-owner decision and periodic review.
RiskControlEvidenceOwnerReview date