Which of the following roles should be assigned accountability for monitoring risk levels?

A risk practitioner typically supports risk owners and performs risk assessments, but the ultimate accountability for monitoring lies with the owner of the risk.

A business manager might have general oversight, but the specific role of 'risk owner' carries the direct accountability for monitoring identified risks.

The risk owner is the individual accountable for a specific risk, which includes not only deciding on a risk response but also continuously monitoring the risk's status, its likelihood, and its impact, as well as the effectiveness of any implemented controls. This ensures ongoing oversight and appropriate adjustments.

A control owner is accountable for the specific controls they manage, not necessarily the overall risk level itself.