Topics in this domain
- Risk Management Concepts and Frameworks
- Inherent Risk, Residual Risk, Appetite and Tolerance
- Threat Actors, Motivations and Attack Vectors
- The Evolving Threat Landscape: AI, Cloud and Supply Chain
- Threat Modelling and Cyber Threat Intelligence
- Vulnerability Assessment and Scanning
- Control Deficiencies and Security Gap Analysis
- The Risk Assessment Process
- Qualitative Risk Analysis: Likelihood and Impact
- Quantitative Risk Analysis: SLE, ALE and Loss Estimation
- Risk Scenarios and Prioritisation
- Risk Treatment Options: Mitigate, Transfer, Avoid, Accept
- Risk Acceptance: Approval, Expiry and Review
- Cost-Benefit Analysis for Risk Treatment
- Risk Ownership vs Control Ownership
- RACI and Risk Escalation Paths
- The Risk Register
- Continuous Risk Monitoring and Key Risk Indicators
- Risk Reporting to Executives and the Board
- Integrating Risk Management into Business and IT Processes
Risk Ownership vs Control Ownership
Why ownership matters
A risk with no owner is a risk nobody is managing. Ownership gives every risk someone who watches it, decides what to do about it and answers for the outcome. “Risk and control ownership” is a named topic in the CISM outline, and one of the CISM job tasks is to define and communicate responsibilities and lines of authority.
Two kinds of owner
| Risk owner | Control owner | |
|---|---|---|
| Accountable for | The risk and its outcome | One control working as designed |
| Usually | A business manager | IT, security, operations or a business process lead |
| Does | Decides treatment; accepts residual risk; monitors KRIs | Designs, runs and evidences the control; reports failures |
| Example | Head of payments, for payment fraud risk | IAM manager, for MFA on payment systems |
They’re often different people. One risk may be treated by several controls with different owners, and one control may treat several risks.
Choosing the right risk owner
- the person whose objectives the risk threatens
- senior enough to decide and fund treatment
- able to accept residual risk within their authority
- named individually, not “the business” or “IT”
Because information risk is business risk, the CISO or IT is rarely the right owner. They may own controls, but the business owns the risk.
How the pieces connect
Example. Risk: “fraudulent payments through compromised finance accounts”. Risk owner: the CFO. Controls: MFA (owned by the IAM manager), payment approval limits (owned by the financial controller) and transaction monitoring (owned by the fraud team lead). Each control owner reports failures to the CFO, who decides whether the risk is still within appetite.
The security manager’s role
- Facilitates: runs the risk process, the method and the register.
- Advises: explains risks and options to owners.
- Owns some controls: security tooling, monitoring, awareness.
- Escalates: when owners don’t act and risk exceeds appetite.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who should own an information risk? | The business manager responsible for the affected objective |
| Who accepts residual risk? | The risk owner, within their authority |
| Who ensures a specific control operates? | The control owner |
| The security manager’s role in ownership | Facilitate, advise and escalate |
| Best way to ensure accountability | Named owners for every risk and control |
In short
- A risk owner is the person accountable for a risk and has the authority to decide how it's treated and to accept what remains.
- Risk owners are usually business managers, because information risk is business risk.
- A control owner is accountable for a specific control being designed, operated and evidenced correctly.
- One risk can be treated by several controls with different owners; one control can treat several risks.
- Every risk and every control needs a named owner, a person rather than a department.
- The security manager facilitates and advises; owning the risk management process isn't the same as owning the risks.
Exam traps
- The CISO or IT is rarely the right risk owner for a business risk.
- 'IT owns it' or 'the business owns it' isn't ownership; name a person.
- Owning a control doesn't mean owning the risk it treats.
- Risk owners need enough seniority and budget authority to act on the risk.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Two kinds of owner