Who is PRIMARILY accountable for risk treatment decisions?

The risk owner is primarily accountable for risk treatment decisions, as they are the person or entity with the authority and responsibility to manage a particular risk. The risk owner shouldevaluate the available risk response options, select the most appropriate one, implement the chosen response, and monitor its effectiveness. The risk owner should also communicate and report on the risk status and any issues or changes. The business manager, data owner, and risk manager are not primarily accountable for risk treatment decisions, although they may be involved in the risk management process. The business manager is responsible for the overall performance and objectives of a business unit or function. The data owner is responsible for the security and quality of a specific data asset. The risk manager is responsible for facilitating and coordinating the risk management activities across the organization. References = Risk and Information Systems Control Study Manual, Chapter 2: IT Risk Identification, page 47.