Which term refers to the person who owns the risk and is accountable for risk-based decisions within the organization?

• A. Risk owner
• B. IT risk register
• C. Risk map
• D. Preventive control

Answer: (A)

Risk ownership means the person responsible for a process or area who has the authority to decide how to handle its risks. The risk owner is accountable for risk-based decisions, including choosing and implementing risk responses, accepting residual risk, and monitoring how well controls are working. This role ensures there is clear accountability and that risk actions align with business objectives, with the risk owner coordinating with risk managers and control owners as needed.

The IT risk register is a repository that records identified risks, their owners, and treatments—not a person. A risk map visually represents risk levels and relationships, not an individual. A preventive control is a type of control designed to stop a risk event from occurring, not a person.