Control owners vs. control performers

Control Owner

The control owner is a person or group that typically defines procedures, monitors the effectiveness of the control, and ensures that it is in compliance with the relevant regulation or standards. Effectiveness and compliance results are often reported to the process owner. In some organizations, the control owner is also the process owner.

Within Strike Graph, each control needs to be assigned to an individual owner. This individual owns (i.e. defines, modifies, and signs off on) the control wording and will most likely review associated evidence to assess whether the control is operating as intended.

Control Performer

A control performer is the individual clicking the button, reviewing the document, addressing a ticket, testing code, or otherwise performing the actions specified within the control on a day-to-day basis. More often than not, this individual is the person the auditor will want to talk to and will gather their evidence. This person is in the trenches. Sometimes the owner of the control is also the control performer. This is fine, especially for small organizations.

Example:

The Network Admin receives a request to grant new hire access to a tool that is not normal for that new hire’s role. The Network Admin will confirm that the appropriate approval is present before provisioning. The Network Admin is the control performer.

The IT Compliance Manager has defined the provisioning control (specific approvals must be present) and other controls and processes around logical access. The IT Compliance Manager is not carrying out the control, just defining it, and is the control owner. Occasionally, the IT Compliance Manager will investigate the performance of the control. This might look like carrying out a user access review to see if newly provisioned staff all have approval tickets pulling a sample of all newly provisioned accounts for one system and ensuring that approval tickets were present.

Questions?

For more guidance, check out our "Control Library" collection or reach out through our chat feature for real-time Customer Success support 8 am - 5 pm PT Monday through Friday.