CRISC: Certified in Risk and Information Systems ControlDemo

The business owner is accountable for the business service and its loss if the application becomes unsupported. That owner has the authority to prioritize, fund, accept, transfer, or require mitigation of the key-person dependency. IT management can implement technical and staffing controls, and risk management can coordinate the process, but neither replaces business accountability for the resulting loss.