CRISC · Question #603
When determining risk ownership, the MAIN consideration should be:
The correct answer is A. who owns the business process.. Risk ownership is primarily assigned to the individual or team responsible for the business process or asset that the risk impacts, as they have the authority and accountability for its operation.
Question
When determining risk ownership, the MAIN consideration should be:
Options
- Awho owns the business process.
- Bthe amount of residual risk.
- Cwho is responsible for risk mitigation.
- Dthe total cost of risk treatment.
How the community answered
(26 responses)- A92% (24)
- C4% (1)
- D4% (1)
Why each option
Risk ownership is primarily assigned to the individual or team responsible for the business process or asset that the risk impacts, as they have the authority and accountability for its operation.
The owner of a risk is typically the individual or entity who has accountability for the asset, system, or business process that the risk could affect, and thus has the authority to make decisions regarding its management and mitigation. This ensures that the person best positioned to control the risk also bears the responsibility for it.
The amount of residual risk is an outcome of risk treatment, not the primary criterion for assigning initial risk ownership.
Responsibility for risk mitigation is often assigned based on risk ownership, but the owner of the process/asset is the foundational point for accountability, not just the mitigation task itself.
The total cost of risk treatment is a factor in deciding how to treat a risk, not in determining who owns the risk.
Concept tested: Risk ownership assignment principles
Topics
Community Discussion
No community discussion yet for this question.