Who owns an ICFR control if a company has both an internal controls team and internal audit?

The control still belongs to management, not to internal audit. In practice, the process owner in finance, operations, or another first-line function is responsible for performing the control. A specialized internal-controls or controllership team may help document, standardize, or monitor the control framework, but that does not shift primary ownership away from management.

Internal audit should stay independent enough to assess whether the control is designed properly and operating effectively. If internal audit starts running the control itself, it weakens the independence needed for later assurance work.

A good way to remember the distinction is:

• management operates,
• oversight functions coordinate or challenge, and
• internal audit evaluates independently.