Topics in this domain
- Exam Technique: Thinking Like a Risk Practitioner
- Aligning IT Risk Management with Business Strategy
- Organisational Structure, Roles and Decision Rights
- Risk Ownership and Accountability
- Segregation of Duties
- Risk Culture and Tone at the Top
- Ethics and Professional Conduct
- Policies, Standards, Procedures and Guidelines
- Policy Lifecycle, Exceptions and Enforcement
- Business Process Review: Ownership and Criticality
- Identifying and Valuing Organisational Assets
- Embedding Asset Management into Risk Governance
- Enterprise Risk Management: Purpose and Principles
- The Risk Practitioner's Role in ERM
- The Three Lines Model and Risk Oversight
- Risk Management Frameworks: ISO 31000, COSO ERM, NIST and COBIT
- Applying a Framework: the Risk Management Life Cycle
- Risk Appetite, Tolerance and Capacity
- Establishing and Maintaining the IT Risk Profile
- Making Risk-Based Business Decisions
- Legal, Regulatory and Contractual Requirements
- Connecting Governance to Risk Outcomes
Risk Ownership and Accountability
What a risk owner is
The risk owner is the person accountable for managing a risk, with the authority and budget to act on it. It’s usually the business manager whose process or objectives the risk threatens, not the person who runs the technology.
Choosing the owner
| Risk | Owner | Not the owner |
|---|---|---|
| Payment fraud in the finance system | CFO | Finance system administrator |
| Customer portal outage | Head of digital sales | Hosting team |
| Supplier data breach | Business owner of the service | Procurement clerk |
Every risk in the register needs one named person, not a team or committee. The person who found the risk isn’t automatically its owner.
What owners do
- Understand the risk and its impact on their objectives.
- Choose a response from the options the practitioner presents.
- Accept residual risk within their authority, and escalate above it.
- Fund and track treatment plans.
- Report status and escalate when needed.
Making accountability real
The risk practitioner helps owners understand their risks, but never takes ownership from them.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who should own an IT-related risk | The business manager accountable for the affected process |
| MOST important attribute of a risk owner | Authority and accountability to act |
| Who accepts residual risk | The risk owner, within their authority |
| Role of the risk practitioner | Help owners understand and manage their risks |
In short
- A risk owner is the person with the accountability and authority to manage a risk, usually the business manager whose objectives it threatens.
- Every risk in the register needs one named owner, a person rather than a team.
- Owners decide the response, accept residual risk within their authority and report on progress.
- Accountability needs clear expectations, named owners, traceable actions, review and fair consequences.
- The risk practitioner helps owners understand their risks but never takes ownership from them.
Exam traps
- Assigning ownership to IT because the risk involves a system.
- Assigning a committee or department as owner instead of a person.
- Treating the person who found the risk as its owner.
- Allowing an owner to accept a risk above their authority.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Making accountability real
1 / 8