Isaca
CISM · Question #164
Which of the following is the responsibility of a risk owner?
The correct answer is D. Approving risk treatment plans. Risk owners are accountable for ensuring that risks are properly managed and that appropriate measures are taken, but they typically do not directly implement or evaluate controls themselves. They approve plans and oversee the execution.
Submitted by luis.pe· Apr 18, 2026Information Security Risk Management
Question
Which of the following is the responsibility of a risk owner?
Options
- AEvaluating control effectiveness
- BApproving the selection of risk mitigation measures
- CImplementing risk treatment plan activities with control owners
- DApproving risk treatment plans
How the community answered
(43 responses)- A2% (1)
- B7% (3)
- C2% (1)
- D88% (38)
Explanation
Risk owners are accountable for ensuring that risks are properly managed and that appropriate measures are taken, but they typically do not directly implement or evaluate controls themselves. They approve plans and oversee the execution.
Topics
#Risk owner#Risk management roles#Risk treatment plans#Accountability
Community Discussion
No community discussion yet for this question.