Which of the following is the responsibility of a risk owner?

The risk owner is the individual or entity with the accountability and authority to manage a risk. Their primary responsibility is to make informed decisions about how a risk will be handled. This culminates in the formal approval of the risk treatment plan, which documents the chosen strategy (e.g., mitigate, accept, transfer, avoid) and the associated resources. This approval signifies that the risk owner accepts the proposed course of action and the resulting level of residual risk on behalf of the organization.

A. Implementing risk treatment plan activities with control owners: Implementation is an operational task typically delegated to control owners or subject matter experts, not the primary role of the accountable risk owner.

B. Evaluating control effectiveness: This is a monitoring and assurance function, often performed by internal audit, compliance, or a dedicated security team to provide data for risk decisions.

D. Approving the selection of risk mitigation measures: While the risk owner does this, it is a subset of approving the entire risk treatment plan (C), which is a more comprehensive and accurate description of their responsibility.

1. ISACA

CISM Review Manual

16th Edition. Domain 2: Information Risk Management

Section 2.4 Risk Treatment / Risk Response. The manual specifies that the risk owner is accountable for a risk and is responsible for approving the risk response or treatment plan

thereby accepting the residual risk.

2. ISO/IEC 27005:2022

Information security

cybersecurity and privacy protection — Guidance on managing information security risks. Clause 8.4.3

"Formulating an information security risk treatment plan

" explicitly states

"The risk owner(s) should approve the information security risk treatment plan and the acceptance of residual information security risks."

3. NIST Special Publication 800-39

Managing Information Security Risk: Organization

Mission

and Information System View. Section 2.3

"Risk Management Roles." This document establishes that senior leaders (who function as risk owners) are responsible for decisions regarding risk

including "decisions regarding the acceptance of risk to the organization

" which is formalized through the approval of risk treatment plans.