In assessing IT risks for Sarbanes Oxley, the term application and data owners is used quite frequently. Application and data owners are part of the business process. Application and data owners are responsible and accountable for a business process. Even though the process as such is executed by some other person in the organziation, the application and data owners would be responsible for the same. Normally, the application and data owners delegate a major chunk of their ownership to other personnel.

It is very important for application and data owners to understand the design and operations of controls within applications. Unless one understands such controls one would not be able to help the IT people in
suggesting better designing the application. Strong detective and monitoring controls can give comfort for weak general controls in an IT environment. Application and data owners can proactively take up the job of assisting IT personnel in designing controls within applications.