CRISC: Certified in Risk and Information Systems Control

The risk owner is accountable for managing the risk within the organization’s risk appetite and business objectives, so the risk owner selects the appropriate treatment option. Risk practitioners may advise, and control owners may implement controls, but accountability for the treatment decision rests with the risk owner.