An IT control gap has been identified in a key process. Who would be the MOST appropriate owner of the risk associated with this gap?

A. Business process owner
B. Chief information security officer
C. Operational risk manager
D. Key control owner