Which of the following is MOST important to ensure when reviewing an organization's risk register?

Assigning risk ownership is crucial because it designates a specific individual or entity responsible for monitoring, managing, and responding to each identified risk. Without clear ownership, risks can be overlooked or mishandled, undermining the entire risk management process and accountability.

While vulnerabilities are components of risk, ensuring they have separate entries in the risk register isn't necessarily the *most* important aspect; risks are often broader concepts than individual vulnerabilities.

Control ownership is important for accountability in control implementation, but it is secondary to risk ownership, which defines who is responsible for the overall risk itself.

Residual risk *should* ideally be less than inherent risk, indicating effective controls, but this is an outcome or state to be achieved, not a foundational element that must be 'ensured' in the register review itself, like ownership.