Who is responsible for managing the threats and vulnerabilities that might exploit a risk, and for reassessing the risk to determine the residual level?

• A. Risk Manager
• B. Owner (Risk)
• C. Security Analyst
• D. Compliance Officer

Answer: (B)

The idea here is about who is accountable for a risk within a business process. The risk owner is responsible for managing the threats and vulnerabilities that could exploit that risk and for reassessing the risk to determine the remaining level after controls are in place. This person owns the risk in practice, ensuring that appropriate mitigations exist, monitoring their effectiveness, and deciding whether the residual risk is acceptable or if more actions are needed. In practice, a security analyst might identify threats and gaps, and a compliance officer ensures policy alignment, while a risk manager may oversee the overall risk program. But the owner—often a business or process owner—holds the accountability for the risk and its residual level.