CRISC: Certified in Risk and Information Systems Control

A risk owner needs the authority to accept, treat, escalate, and resource a risk. Assigning that accountability to a staff member rather than a department manager can leave the role without the decision-making authority needed to manage the risk effectively.