Exam CGEIT topic 1 question 10 discussion

B should be, A is not right as cant be responsible for the Application and conflict of interest as wouldn't be able to Audit himself/herself

Definitely not A because Internal audit is not accountable for applications. In this scenario, they have mentioned, CIO is accountable for controls.

CIO is accountable

B. CIO. As the main transactional application is an IT system, it is the responsibility of the Chief Information Officer (CIO) to ensure that governance controls are implemented effectively. The CIO is responsible for managing the enterprise's IT infrastructure, ensuring that it complies with regulations, and managing risks associated with IT systems. Therefore, accountability for the controls is best assigned to the CIO. While the internal audit director may provide oversight and ensure that controls are operating effectively, the ultimate responsibility lies with the CIO who has a more comprehensive understanding of the enterprise's IT infrastructure and systems. The board of directors provides governance oversight but is not typically responsible for day-to-day operational matters. Application users are typically responsible for using the system appropriately, but not for implementing or managing governance controls

G5-9 Review Question; CIO is overall accountable for IT function

My thought is BOD should be accountable while IA director to be responsible.