Which of the following should be done FIRST when a new risk scenario has been identified

Estimating residual risk comes after inherent risk assessment and considering potential controls, which can only happen effectively once ownership is established and initial risk treatment considered.

Establishing Key Risk Indicators (KRIs) is part of monitoring the risk, which occurs after the risk has been identified, assessed, and treatment strategies (including ownership) are in place.

Designing control improvements is a risk treatment step that occurs after the risk is identified, assessed, and an owner is assigned to lead the treatment effort.

Identifying the risk owner is foundational to effective risk management. The owner is accountable for the risk and its treatment, making this the crucial first step before further analysis or control design can proceed responsibly. Without an owner, there's no clear accountability for managing the risk.