The risk owner is the person accountable for deciding how a specific Risk to an Asset is treated — accepted, mitigated, transferred or avoided. The risk owner signs off on the residual risk after Controls have been applied and re-evaluates that decision periodically or whenever the risk profile changes.

The risk owner is often, but not always, the same person as the Asset owner. In larger organisations the two roles are frequently split: the asset owner focuses on the asset's operational value, while the risk owner sits closer to governance and is accountable for the risk decision itself.