By default, who is assigned to complete control attestations in the baseline?

• A. Audit Owner
• B. Risk Owner
• C. Control Owner
• D. Entity Owner

Answer: (C)

Attestations are confirmations that a control is operating effectively, and the baseline assigns this task to the person who owns and is directly responsible for the control. The control owner is the most knowledgeable about how the control is designed, implemented, and evidenced, so they are best positioned to verify its ongoing effectiveness. This creates clear accountability and ensures attestations reflect the actual operation of the control. The other roles—an audit owner focuses on audits, a risk owner oversees risk exposure, and an entity owner represents the business unit—do not default to attestation completion because they are not the party primarily responsible for the control’s day-to-day operation and evidence.