3.2.2. Risk and Control Ownership
💡 First Principle: The person accountable for a risk's business outcome and the person who implements the control that manages it are frequently different people — conflating the two roles is how controls get built without anyone actually owning whether they work.
A business unit leader is typically the risk owner — accountable for the outcome if a risk materializes, and the person with authority to accept, mitigate, or otherwise treat it. The control owner — often within IT or security — is responsible for implementing and operating the specific control chosen to manage that risk. These roles need each other: a risk owner without a control owner has no mechanism to act on their decision, and a control owner without an engaged risk owner has no one accountable for whether the control is actually worth its cost and friction.
⚠️ Exam Trap: The exam frequently assumes a single person handles a risk end-to-end. The correct reasoning recognizes that risk ownership (accountability for the outcome) and control ownership (responsibility for execution) are commonly split across a business owner and a technical function, and both roles must stay engaged for risk management to function.
Reflection Question: A control implemented by the IT department to mitigate a business risk keeps failing silently, and no one in the business unit that owns the risk has noticed for six months. What does this reveal about how risk and control ownership were structured?
