What is a risk owner?
A risk owner is the named individual who answers for a single risk: they confirm its assessment, decide on its treatment and accept the residual risk. The role is a decision-making authority, not a field on a form.
BSI Standard 200-3 is the risk analysis standard of Germany's Federal Office for Information Security (BSI). In its preparatory work for the risk analysis (chapter 2), it asks whether risks are assigned to their risk owners. How the role fits into the overall process is covered in the entry on risk management.
What does a risk owner do?
A risk owner takes five decisions and follows them up:
- Confirm the assessment: are likelihood and impact plausible from a business point of view?
- Choose the treatment: avoid, reduce, transfer or accept.
- Commission the controls: with a deadline, an owner and resources.
- Accept the residual risk, or escalate it where it exceeds their own authority.
- Monitor: report changes in the situation and the effectiveness of the controls.
Monitoring is what separates the owner from an approver, because the role does not end when the treatment plan is approved.
Which ISO 27001 clauses require a risk owner?
ISO/IEC 27001 anchors the role in two clauses of the risk process. Clause 6.1.2 ties every identified risk to an owner, and under clause 6.1.3 the risk owners sign off the planned treatment and the risk that remains.
BSI Standard 200-3 puts the emphasis elsewhere: under chapter 6, the residual risk has to be submitted to the management level for approval. Organisations working to ISO/IEC 27001 on the basis of IT-Grundschutz therefore have the residual risk accepted by the risk owner and confirmed by management.
Five roles, five responsibilities
The risk owner is accountable for the risk, not for implementing every control and not for the method:
| Role | Accountable for | Suitable holder |
|---|---|---|
| Risk owner | the risk and the decision on its treatment | area or process owner with a budget |
| Action owner | implementing a single control, in time and quality | subject-matter or project lead |
| Asset owner | an information asset across its lifecycle | the business function the asset serves |
| Process owner | the performance and metrics of a process | line manager |
| Information security officer or risk manager | method, consolidation, reporting | staff function |
Several roles may coincide in one person, with one exception: whoever runs the method should not also decide on accepting its results.
Three rules for choosing a risk owner
The right person can influence the cause of the risk and has the resources to commission controls. Three rules follow:
- Always a person, never a committee. A committee can advise, but it cannot be personally accountable.
- As low as possible, as high as necessary. The level has to match the size of the residual risk; above defined thresholds, executive management decides.
- Not automatically IT. The risk that a business application fails belongs to the function that owns the process; IT is the action owner.
An assignment fails when the owner has neither the authority nor the knowledge, for example in these four patterns:
- All IT-related risks sit with the information security officer or the head of IT, who own neither the process nor the budget.
- The owner learns of the role only during the audit.
- Residual risks are accepted by people whose authority to do so has not been defined.
- When people change jobs the assignment is not handed over, and risks formally belong to someone who has left the area.
How Rizzqo carries risk ownership
In Rizzqo every risk assessment carries its own field for the risk owner and runs through the approval path not assessed, in review and assessed. Likelihood in per cent and impact in euros give the risk level through a configurable matrix, separately for the inherent, current and residual value.
Measures the risk owner decides on run as tasks with a planned risk reduction. While a task is open the reduction is reserved; on completion it is applied. Every asset also carries its own owner, so asset owner and risk owner are named separately.