Which statement about risk ownership is most accurate?

• A. A formal title with no responsibilities
• B. Individuals or roles assigned to manage specific risks, implement controls, and report results
• C. A tool used to assign risk to departments
• D. A risk measure that increases accountability

Answer: (B)

Risk ownership is about assigning responsibility for a specific risk to a person or role who will actively manage it, put in place controls, and report on the results. This ensures there is a accountable person who monitors risk indicators, implements mitigations, and communicates status to stakeholders. It’s not just a title or label without duties, so a formal title with no responsibilities wouldn’t constitute ownership. It isn’t a tool used to assign risk to departments, either, since ownership is about who is responsible, not a mechanism for dividing risk. And it isn’t a risk measurement, since ownership is a responsibility assignment, not a metric. The best statement captures the idea that a specific individual or role is responsible for managing the risk, implementing controls, and reporting results.