Which of the following is the HIGHEST risk of a policy that inadequately defines data and system ownership?