An external auditor identifies a control weakness. Who should ordinarily own the resulting business risk?

1. The accountable business or process owner
2. The newest member of the risk team
3. The external auditor who found it
4. The tool supplier whose scanner detected it