Which statement regarding organizational roles, responsibilities, and authorities is NOT correct?

Top management is responsible for ensuring that roles, responsibilities, and authorities for information security are assigned and communicated. While they are accountable for the performance of the ISMS, the responsibility for reporting on the performance of the ISMS can be delegated to others (e.g., ISMS manager, management representative), as explicitly stated in the standard.

“Top management shall assign the responsibility and authority for reporting on the performance of the ISMS to top management.”

— ISO/IEC 27001:2022, Clause 5.3