Risk Owner

The concept of a risk owner exists because risks that belong to everyone are managed by no one. A register full of risks without named owners gives the board a list, not control. Assigning each risk to one named manager creates a person who can be asked, in a meeting with a date, what has changed since last quarter. For owners and directors, that is the difference between a risk process and risk theatre.

Ownership is recorded in the risk register and reinforced in the manager's objectives and in RACI matrices over controls. The owner is accountable for the risk and for the treatment plan, even when other teams execute the controls. Example: the risk of supply disruption for a key production line is owned by the supply chain director, who reports control status and residual exposure to the risk committee, while procurement and logistics run the day-to-day mitigations. If the owner changes roles, the register is updated the same month, not at the annual review.

The most common mistake is assigning risks to the CRO, the risk department or a committee. The CRO owns the framework, not the business risks; a committee cannot be accountable because accountability does not divide. Owners must be managers senior enough to commit resources in the area where the risk actually lives. How ownership connects to appetite and the register is covered in ERGP module M2, on risk.