Which of the following groups would be in the BEST position to perform a risk analysis for a
business?

A.
External auditors

B.
A peer group within a similar business

C.
Process owners

D.
A specialized management consultant

Explanation:

Process owners have the most in-depth knowledge of risks and compensating controls within their
environment. External parties do not have that level of detailed knowledge on the inner workings
of the business. Management consultants are expected to have the necessary skills in risk
analysis techniques but are still less effective than a group with intimate knowledge of the
business.