A risk practitioner is reviewing accountability assignments for data risk in the risk register. Which of the following would pose the GREATEST concern?

The risk owner and control owner can be distinct roles, as the risk owner is responsible for the overall risk, while the control owner is responsible for specific controls mitigating it.

It is often appropriate and even preferred for risk owners to be in business units, as they are closest to the business impact of the risk and understand its context.

Assigning an entire department as the risk owner lacks the specificity needed for effective risk management because it dilutes individual accountability, making it difficult to identify a single person to drive decisions, track progress, or be held responsible for the risk's treatment. Effective risk ownership requires a designated individual who can make informed decisions and commit resources.

While a manager might be preferred for risk ownership, a competent and authorized staff member could still be an effective risk owner, depending on the organizational structure and delegation of authority.