Glossary · Foundations
Risk Owner
The person accountable for a specific risk and the decisions about how it is treated.
Put the term into practice: Risk management software
A risk owner is the individual with the authority and responsibility to manage a particular risk. ISO/IEC 27001 expects each risk in the risk register to have a named owner who approves the treatment plan and accepts any residual risk.
Assigning clear ownership prevents risks from being noted and then ignored. The owner monitors the risk over time and ensures agreed controls are implemented and effective.
