Who should be accountable for authorizing information system access to internal users?

According to the ISACA Risk and Information Systems Control study guide and handbook, the information owner is the official with statutory or operational authority for specified information and responsibility for establishing the controls for its generation, collection, processing, dissemination, and disposal. The information owner is also responsible for authorizing access to the information within their domain, based on the principle of least privilege and the need toknow. Therefore, the information owner should be accountable for authorizing information system access to internal users12

1: ISACA Risk and Information Systems Control Study Guide, 4th Edition, page 33 2: ISACA Risk and Information Systems Control Handbook, 1st Edition, page 25