Which term describes any person or group that has responsibility for, an expectation from, or an interest in the enterprise?

• A. Asset
• B. Advanced persistent threat
• C. Risk governance
• D. Stakeholder

Answer: (D)

A stakeholder is any person or group that has responsibility for, an expectation from, or an interest in the enterprise. This includes internal parties like employees and managers as well as external ones such as customers, suppliers, regulators, shareholders, and the broader community. Recognizing stakeholders helps ensure risk information, decisions, and governance consider the needs and concerns of all those who are affected or who can influence the organization’s risk posture.

This concept matters because it links risk management to accountability and communication. Stakeholders shape risk appetite and requirements, demand appropriate assurance, and influence how risk is prioritized and addressed.

By contrast, an asset is a resource of value to the organization, not a group of people or groups with interests. Risk governance is the overarching structure and processes for directing risk management, not the parties involved. An advanced persistent threat is a type of attacker, not a description of who has an interest in the enterprise.