The person in whom the enterprise has invested the authority and accountability for making risk-based decisions and who owns the loss associated with a realized risk scenario?

• A. Risk owner
• B. Risk map
• C. IT risk register
• D. Preventive control

Answer: (A)

The main idea here is risk ownership: the person who is given the authority to make decisions about a risk and who is accountable for what happens if that risk materializes. A risk owner is designated to manage a specific risk, decide on treatment options (acceptance, mitigation, transfer, or avoidance), implement controls, monitor triggers, and report on progress. Crucially, they also bear accountability for the loss or impact if the risk becomes real, since they hold the responsibility for the risk’s outcome within their area of ownership.

The other items are tools or controls rather than the person accountable for decisions and losses: a risk map is a visual representation of risk levels, an IT risk register is a record of identified risks and their owners and controls, and a preventive control is a measure designed to reduce the likelihood or impact of a risk. Therefore, the correct concept is the risk owner.