EXAM-005 - Responsibility vs Accountability

Topic Summary

Roles and responsibilities must be defined, communicated, accepted, and kept current. Managers remain accountable for ensuring security requirements are followed in their area.

Key Concepts

• Responsibility: assigned duty or task.
• Accountability: ownership of results and consequences.
• Delegation does not automatically remove accountability.
• RACI helps clarify who is responsible, accountable, consulted, and informed.

Common Exam Traps

• Saying “everyone is responsible” is enough.
• Assuming the security team owns all security outcomes.
• Confusing role assignment with proof of operation.

Related Notes

• Roles and Responsibilities
• A.5.2 Information Security Roles and Responsibilities
• A.5.4 Management Responsibilities
• RACI Matrix