The person accountable for a specific risk and the decisions about how it is treated.
A risk owner is the individual with the authority and responsibility to manage a particular risk. ISO/IEC 27001 expects each risk in the risk register to have a named owner who approves the treatment plan and accepts any residual risk.
Assigning clear ownership prevents risks from being noted and then ignored. The owner monitors the risk over time and ensures agreed controls are implemented and effective.
KaitoSec