After reading, you can name the right owner for a risk and tell that role apart from the people doing the work.
Definition
ISO Guide 73 defines the risk owner as the person or entity with the accountability and authority to manage a risk. ISO/IEC 27001 relies on the same idea in clauses 6.1.2 and 6.1.3.
Owning a risk does not mean doing the work. An IT engineer may well install the control for a risk owned by the head of sales.
Why it matters
Look at the oldest open lines in most risk registers and you will often find the same thing: nobody with a budget is attached to them. A risk without a real owner has nobody to decide, so it stays open until it happens.
Business risks often land on the IT manager by default. That person can neither change the sales process nor accept a lost contract, so the risk just sits there.
How it works
A useful test is to ask who feels the consequence and who controls the budget of the activity at risk. The answer is usually one person, and that person is the owner.
Make the role concrete. The owner chooses the treatment option, approves the actions, accepts the residual risk and reports on it at each review.
Record the name or the single-holder function in the register. When that person moves on, reassign the risk during the handover, not at the next audit.
A worked case
“Orders cannot ship if the warehouse system stops” belongs to the logistics director, who would lose the deliveries and who funds the backup process. The IT manager runs the failover test as action owner.
When the test fails, the question goes back to the logistics director: pay for a second site, or accept a two-day stop? That decision could never have been made in IT.
Good practices
- Check that the proposed owner can actually spend money or stop an activity.
- Keep separate columns for the risk owner and the action owner, because they are often different people.
- Have owners sign the acceptance of residual risk themselves.
- Show management the risks held by each owner. The role gets taken seriously once it is visible.
Common mistakes
- Handing every risk to the security manager. It looks tidy, and it takes the decisions away from the people who should make them.
- Naming a committee or a department. When everyone owns a risk, nobody has to answer for it.
- Choosing someone too junior to live with the consequences, usually because they were the only one in the workshop.
- Leaving people who have left the company as owners, which an auditor will notice in minutes.
Questions
- What is the difference between a risk owner and a control owner?
- The risk owner answers for the risk and its acceptance. A control owner runs one specific control that reduces it.
- Can a risk have two owners?
- It should not. When two departments are concerned, one person decides and consults the other.
- Who assigns risk owners?
- The person running the risk process usually proposes them, and management confirms.
- Does ISO 27001 require risk owners?
- Yes. Clause 6.1.2 asks you to identify them, and clause 6.1.3 asks for their approval of the treatment plan.
- Can a risk owner refuse the role?
- They can argue the risk belongs elsewhere, and management settles it. The risk still needs a name at the end of that conversation.