An organization's Internet-facing server was successfully attacked because the server did not have the latest security patches. The risk associated…

The risk owner is the person who should be accountable for any related losses to the organization,

because they are the person who has the authority and responsibility to manage the risk and its

associated controls.The risk owner is also the person who accepts the risk and its residual level, and

who monitors and reports on the risk status and performance. The IT risk manager, the server

administrator, and the risk practitioner are all involved in the riskmanagement process, but they are

not the person who should be accountable for the risk and its outcomes, as they do not have the

ultimate decision-making power and accountability for therisk. Reference = Risk and Information

Systems Control Study Manual, Chapter 3, Section 3.1.1, page 79