A risk register is a tool that records and tracks the identified risks, their causes, impacts, likelihood, responses, and owners. The owner for each risk scenario is the person or group whohas the authority and accountability to manage the risk and its response. The best way to identify the owner for each risk scenario in a risk register is to map the identified risk factors tospecific business processes. Risk factors are the internal and external variables that influence the occurrence and impact of risks. Business processes are the activities that produce value for the enterprise, such as sales, marketing, production, or delivery. By mapping the risk factors to the business processes, the risk practitioner can determine which business process is affected by or contributes to the risk, and who is responsible for the business process. The owner for each risk scenario should be the person or group who is responsible for the business process that is associated with the risk. The other options are not the best way to identify the owner for each risk scenario, as they involve different criteria or methods:
Determining which departments contribute most to risk means that the risk practitioner evaluates the degree of involvement or exposure of each department to the risk. This may not be a reliable or consistent way to identify the owner for each risk scenario, as the risk may span across multiple departments, or the department may not have the authority or accountability to manage the risk.
Allocating responsibility for risk factors equally to asset owners means that the risk practitioner assigns the same level of responsibility to each person or group who owns an asset that is affected by or contributes to the risk. An asset is a resource that has value for the enterprise, such as hardware, software, data, or people. This may not be a fair or effective way to identify the owner for each risk scenario, as the asset owners may have different levels of involvement or exposure to the risk, or may not have the authority or accountability to manage the risk.
Determining resource dependency of assets means that the risk practitioner analyzes the relationship and interdependence of the assets that are affected by or contribute to the risk. This may help to identify the potential impact or likelihood of the risk, but it does not directly help to identify the owner for each risk scenario, as the resource dependency may not reflect the authority or accountability to manage the risk. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 3, Section 3.1.1.1, pp. 95-96.
