Roles and Responsibilities in Risk Management
Roles and responsibilities in risk management
MoR defines roles so that risk management has clear accountability. The exam tests who owns what, especially the difference between the risk owner, the risk action owner and the risk manager. Accountability cannot be delegated to a facilitator.
Key roles
- Senior responsible owner (SRO): accountable for the initiative or business area achieving its objectives and for the risk management approach being applied.
- Risk owner: accountable for a specific risk, with authority to manage it and resources to act. The risk owner monitors the risk and ensures responses remain appropriate.
- Risk action owner (response owner): implements one or more response actions; may be different from the risk owner.
- Risk manager or coordinator: facilitates the process, maintains guidance and tools, supports risk owners and prepares reports; does not normally own all risks.
- Assurance: provides independent challenge that risk management is effective.
- Governance board and stakeholders: approve appetite, review escalated risks and make decisions.
Worked example
A cyber-risk is identified. The CIO is the risk owner because she has authority over the systems and budget. A security lead is the risk action owner for implementing multi-factor authentication. The risk manager updates the register and schedules a review, but does not decide the response. The SRO ensures the risk is considered at board level. The reasoning is that ownership sits where authority and accountability meet.
Traps
- Naming the risk manager as owner of every risk.
- Confusing the person doing the action with the person accountable for the risk.
- Assigning a risk owner who lacks authority or resources.