Depends on the nature of the software. If it's for monitoring servers, IT has control. If it's for business, business has (should have) control.

I agree with the response submitted by Chris. I think the challenge that exists for many organizations at the point where business owners are actually given the "control" or administrative responsilities they've long sought, is they don't know how to "take control" or they never thought the day would come when they would get control. Whether it's lack of knowledge or time, or simply a reluctance to actually dig in and take responsibility, often they balk at the new opportunity. I always say it's a "be careful what you ask for because you might just get it" thing. I think this specific opportunity is much more accentuated with Saas solutions where IT involvement is minimized and business owners can maintain intricate control over their business information.