A new risk practitioner finds that decisions for implementing risk response plans are not being made. Which of the following would MOST likely explain this situation?

When risk ownership is not clearly assigned, there is no single individual or team accountable for making decisions about how to respond to identified risks or for ensuring that mitigation plans are executed. This ambiguity often leads to inaction, as everyone assumes someone else is responsible or no one has the explicit authority to move forward.

A high level of risk appetite might influence what decisions are made (e.g., accepting more risk), but it doesn't prevent decisions from being made altogether.

Outdated risk management procedures might lead to inefficient or ineffective plans, but not necessarily a complete absence of decision-making on existing plans.

An ineffective risk awareness program could mean staff don't understand risks, but it doesn't directly explain why decisions on response plans are not being made once risks are identified.