The party that is ultimately held accountable for a resource or control is ________.

• A. the owner
• B. the trustee
• C. the accredited security officer
• D. the certified security officer

Answer: (A)

The key idea is that accountability for a resource or control rests with its owner. The owner is the person or entity with the authority to define how the resource is used, approve access, allocate resources, and accept or remediate risk. They bear the ultimate responsibility to management, auditors, and regulators for whether protections are in place and functioning. Those who implement or enforce security controls—such as security officers or custodians—act under the owner’s direction and are responsible for carrying out the required duties, but they do not carry the final accountability if something goes wrong. While a trustee can manage assets held in trust, in this context the person who holds ultimate accountability for the resource is the owner.