The greatest concern for a risk practitioner when process documentation is incomplete is the inability to identify the risk owner. The risk owner is the person or entity that has the authority and responsibility to manage a specific risk or a group of related risks. The risk owner helps to identify, assess, and respond to the risks, and to monitor and report on the risk performance and improvement. The risk owner also helps to communicate and coordinate the risk management activities with the relevant stakeholders, such as the board, management, business units, and IT functions. The risk owner is usually identified in the process documentation, which describes the roles, responsibilities, procedures, and resources for each process. The inability to identify the risk owner is a major concern for the risk practitioner, because it may affect the accountability, transparency, and effectiveness of the risk management process, and may lead to confusion, conflicts, or gaps in the risk management activities. The other options are not as concerning as the inability to identify the risk owner, although they may also pose some difficulties or limitations for the risk management process. Inability to allocate resources efficiently, inability to complete the risk register, and inability to identify process experts are all factors that could affect the quality and timeliness of the risk management process, but they do not necessarily affect the authority and responsibility of the risk management process. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.2.1, page 2-11.
