Who is ultimately accountable for risk treatment?
The risk owner has ultimate accountability for managing the assigned risk and ensuring its treatment is appropriate and carried out. Control owners may operate specific controls, and risk practitioners or ERM functions may advise and oversee, but they do not replace the risk owner’s accountability.
Community Discussion