A risk owner is best described as who and what are their responsibilities?

• A. The external auditor responsible for annual control validation.
• B. A project sponsor approving budgets for risk initiatives.
• C. The person responsible for managing a specific risk, implementing controls, and reporting status.
• D. The compliance officer who writes policies.

Answer: (C)

A risk owner is the person who has accountability for a specific risk within the organization. They’re responsible for managing that risk end-to-end: identifying and understanding it, deciding on and implementing the appropriate controls, and continuously monitoring and reporting the risk’s status to stakeholders. This role carries the authority to allocate resources, drive action plans, and escalate issues when controls fail or the risk level changes. In practice, the risk owner ensures that risk responses are executed and that governance bodies are kept informed with up-to-date information about risk exposure and control effectiveness.

Why this fits best: it captures the ongoing stewardship, control implementation, and regular reporting that define ownership of a risk.

Why the other roles don’t fit as the risk owner: an external auditor is an independent evaluator of controls, not the person responsible for managing and reporting on a specific risk; a project sponsor focuses on approving budgets for risk initiatives rather than owning the risk day-to-day; a compliance officer designs policies and oversees compliance programs, but does not carry the ongoing ownership and operational responsibility for a single risk.