Glossary term
Risk Owner
Subject: Risk Management, Risk Fundamentals and Frameworks
A risk owner is the person with the accountability and authority to manage a specific risk, including deciding on treatments and reporting its status. The role usually sits in the business, not in the risk function.
Explanation
The owner is named in the risk register against each risk. Usually this is a senior manager who controls the process or budget the risk affects: the head of procurement for a supplier failure, the head of IT for a system outage. Duties include confirming the rating is fair, agreeing treatments with other managers, seeing that actions are finished on time, watching indicators and escalating when the risk goes beyond appetite. The owner may delegate actions but stays answerable. A risk owner differs from a control owner, who is responsible for operating a single control, and from the risk function, which advises and challenges. Where owners are missing or too junior, risks drift. When a risk has no named owner with real authority, actions stall because everyone assumes someone else has them.
Example
An online marketplace's register lists a payment fraud risk. The owner is the head of payments, not the fraud team. She agrees extra checks with engineering, accepts a small rise in customer friction and reports monthly losses to the risk committee. When losses pass the early-warning level, she presents a revised plan.
Not to be confused with
- Control Owner
- A control owner operates or maintains one control; a risk owner answers for the overall risk and chooses how to treat it.