An IT operations team implements disaster recovery controls based on decisions from application owners regarding...

According to the CRISC Review Manual1, the application owner is the person who has the authority and accountability for the achievement of the application objectives and the management of the associated risks. The application owner is responsible for defining the level of resiliency needed for the application, which is the ability of the application to recover from disruptions and continue to operate. The application owner is also responsible for accepting or rejecting the residual risks after the implementation of the disaster recovery controls, which are the measures to restore the application functionality and data in the event of a disaster. Therefore, the risk owner in this scenario is the application owner, as they are the ones who will be affected by the potential impact of the disaster on the application and its objectives. References = CRISC Review Manual1, page 194.