When assigning a risk owner, the MOST important consideration is to ensure the owner has:

The correct answer is D. decision-making authority and the ability to allocate resources for risk. A risk owner must be able to act on the risk - which requires decision-making authority and the ability to allocate resources (D). Without these, a risk owner cannot authorize treatments, fund controls, or direct remediation efforts, rendering the role ineffective regardless of…

Submitted by stefanr· Apr 18, 2026Information Security Risk Management

Question

Options

Aadequate knowledge of risk treatment and related control activities.
Brisk communication and reporting skills to enable decision-making.
Csufficient time for monitoring and managing the risk effectively.
Ddecision-making authority and the ability to allocate resources for risk.

How the community answered

(16 responses)

A
13% (2)
B
6% (1)
C
6% (1)
D
75% (12)

Explanation

A risk owner must be able to act on the risk - which requires decision-making authority and the ability to allocate resources (D). Without these, a risk owner cannot authorize treatments, fund controls, or direct remediation efforts, rendering the role ineffective regardless of their knowledge or time. Option A (knowledge of risk treatment) is valuable but secondary - a knowledgeable person without authority cannot implement decisions. Option B (communication skills) supports reporting but does not enable action. Option C (sufficient time) matters operationally but is irrelevant if the person lacks the power to act. Authority is the foundational prerequisite for effective risk ownership.

Topics

#Risk owner#Risk management roles#Decision-making authority#Resource allocation

Community Discussion

No community discussion yet for this question.

Full CISM Practice