What is a risk owner?
A risk owner is the named individual accountable for managing a particular risk. That person decides how the risk will be treated, makes sure the treatment happens, accepts whatever risk is left and answers for the outcome. ISO's risk management vocabulary (ISO Guide 73) defines the role as the person or entity with the accountability and authority to manage a risk, and both halves matter: an owner without authority can't pay for a fix, and authority without accountability lets risks drift.
Who should own a risk
The risk owner is usually the business leader whose operations would suffer if the risk came true and who controls the budget for that area. If the risk is a breach of the customer relationship management system, the head of sales is a natural owner; for a risk to payroll, the CFO or the head of HR. Security leaders own risks to the security program itself, but rarely business risks, because they can neither absorb the consequences nor make trade-offs on the business's behalf.
Ownership goes to a role held by a specific person, not to a department. IT as a whole, or the business in general, can't sign an acceptance or be asked why a deadline slipped.
What a risk owner does
- Confirms the risk is described and rated correctly, with input from security and the people who run the process.
- Chooses the treatment: mitigate, transfer, avoid or accept.
- Approves the treatment plan and its budget, and assigns actions with due dates to control owners.
- Formally accepts the residual risk, or escalates it when it exceeds what they are authorized to accept.
- Reviews the risk when circumstances change and at each scheduled review of the register.
ISO/IEC 27001 builds this into its requirements: risk owners must be identified, and their approval is needed for the risk treatment plan and for accepting residual risk.
Example: one risk, three roles
| Role | Person | Responsibility |
|---|---|---|
| Risk owner | VP of Sales | Accountable for the risk that customer records in the CRM are exposed; approves the MFA budget and signs off on residual risk |
| Control owner | CRM administrator | Configures and maintains MFA and quarterly access reviews in the CRM |
| Adviser | Security analyst | Identifies and rates the risk, recommends controls and tracks progress in the register |
If the analyst finds that MFA isn't enforced for API access, the analyst reports it, the administrator fixes it, and the VP decides whether the exposure that remains is acceptable.
Risk owner vs. similar roles
- Control owner: runs a specific control, such as backups or MFA, but doesn't decide whether the overall risk is acceptable.
- Data owner or asset owner: accountable for an asset's classification and access. The same person may also own risks to that asset, but the roles are distinct.
- Data custodian: handles day-to-day care of data on the owner's behalf.
- Risk manager or CISO: runs the risk process and advises owners, but doesn't personally take on every risk.
Risk owner on the CompTIA Security+ exam
Assigning an owner to each risk is part of SY0-801 objective 5.2, which covers the risk management process and the risk register. When a question asks who should decide whether to accept a risk, approve a treatment or fund a control, the answer is the risk owner, usually a business leader, not the analyst who found the issue or the administrator who maintains the system. Distractors include the data custodian, the control owner and the security team in general. A risk with no owner is a common audit finding, because nobody has made a decision about it.