Who should be responsible for determining which stakeholders need to be involved in the development of a risk scenario?

The risk owner is accountable for managing a specific risk and its controls but typically relies on the practitioner to facilitate the scenario development process.

The risk practitioner is the individual primarily responsible for facilitating and coordinating the risk assessment process, which includes defining and developing risk scenarios. They possess the expertise to identify the various subject matter experts and business representatives whose input is necessary to create accurate and relevant scenarios for the organization.

A compliance manager focuses on regulatory adherence and specific compliance risks, which is a subset of the broader risk scenario development that requires a wider range of input.

A control owner is responsible for the operation and effectiveness of specific controls, not for identifying all stakeholders required for comprehensive risk scenario development.