Risk treatment is the process of selecting and implementing the appropriate risk response strategy and actions to address the identified risks. Risk treatment can involve different strategies, such as avoiding, reducing, transferring, or accepting the risk. Risk owner is the person or group who has the authority and accountability to manage the risk and its response. Risk owner is accountable for risk treatment, as they are responsible for deciding, approving, and executing the risk treatment plan, and for monitoring and reportingthe results and outcomes of the risk treatment. The other options are not accountable for risk treatment, as they have different roles or responsibilities in the risk management process:
Enterprise risk management team is the group of risk managers and practitioners who support the enterprise-wide risk management program, and provide guidance and direction to the risk owners and stakeholders. Enterprise risk management team may advise or assist the risk owner in risk treatment, but they are not accountable for risk treatment.
Risk mitigation manager is the person who designs, implements, and monitors the risk mitigation actions or measures that reduce the likelihood or impact of the risk to an acceptable level, such as controls, policies, or procedures. Risk mitigation manager may advise or assist the risk owner in risk treatment, but they are not accountable for risk treatment.
Business process owner is the stakeholder who is responsible for the business process that is supported by the IT system or application, such as the CRM system. Business process owner may be affected by or contribute to the risk, and may be involved in the risk treatment, but they are not accountable for risk treatment, unless they are also the risk owner. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 3, Section 3.1.1.1, pp. 95-96.
