Who is ULTIMATELY accountable for risk treatment?

A risk owner is typically a senior manager or executive who has the responsibility and authority to manage the specific risk and its associated controls, including approving and overseeing risk treatment plans. They bear the ultimate accountability for ensuring the risk is managed to an acceptable level.

ERM is a framework or function that oversees risk management across the enterprise, but individual accountability for specific risks resides with designated risk owners.

A risk practitioner facilitates and performs risk assessments and advises on treatment, but does not typically hold ultimate accountability for the risk itself.

A control owner is responsible for the operation of specific controls, which contribute to risk treatment, but the risk owner is accountable for the overall risk and its treatment.