An enterprise is implementing its first mobile sales channel. Final approval for accepting the associated IT risk should be obtained from which of the following?

A risk manager identifies, assesses, and monitors risks, but typically does not hold the authority for final risk acceptance; that responsibility lies with those accountable for the business outcome.

The business sponsor, as the owner of the business initiative (the mobile sales channel) and responsible for its success and impact on the enterprise, is ultimately accountable for accepting the associated business and IT risks. They are best positioned to weigh the benefits of the new channel against its inherent risks and make the final decision on risk acceptance.

The Chief Information Officer (CIO) is responsible for managing IT risks, but final business risk acceptance for a new business channel generally rests with the business owner, who owns the overall success and risk profile of the initiative.

An IT steering committee provides governance and oversight for IT initiatives, but while they may recommend or advise on risk, the ultimate acceptance of business risk for a new channel typically resides with the business sponsor.