In the baseline, who is assigned to complete control attestations by default?

The correct answer is that the Control Owner is assigned to complete control attestations by default in the baseline setup within ServiceNow's Risk and Compliance module. This is because the Control Owner is typically responsible for the creation, implementation, and ongoing management of a control. Since control attestations involve verifying that the controls are operating as intended and are effective at mitigating risk, it naturally falls within the purview of the Control Owner to complete these attestations.

The Control Owner’s role encompasses oversight and operational responsibility for controls defined within the risk management framework. Thus, they are best positioned to assess and attest to the effectiveness of the controls, making them the default assignees for this task. This setup ensures accountability and provides a clear line of responsibility for the management of controls in the organizational risk posture.

This assignment reflects the emphasis on clear ownership within risk and compliance management practices, as having designated individuals accountable for specific tasks enhances the overall governance and effectiveness of risk management efforts.