CGEIT: Certified in the Governance of Enterprise ITDemo

Defined roles and responsibilities establish who owns risks, performs assessments, approves or accepts risk, implements treatment actions, and monitors results. This accountability is necessary for a risk assessment and response approach to operate. ISACA notes that roles and responsibilities should be clearly defined so stakeholders understand what is expected during a risk assessment.