A control owner is the person accountable for operating a security or compliance control, or verifying that it works as intended. For example, an owner might ensure access reviews happen on schedule, check that backups are tested, or keep evidence of a required procedure.
Clear ownership helps controls stay effective and makes gaps easier to identify. In practice, GRC systems assign owners to controls and route them review tasks, reminders, and evidence requests. If an owner lacks time or responsibility is unclear, checks may be missed and records can become stale, creating a false impression of coverage. Organizations should assign each control to an appropriate person and review its status and evidence regularly.