Who has the authority to approve risk levels?

Question

From a basic understanding of risk management, a risk register records the risks of an organization, its mitigating controls, etc. Who has the authority to approve residual risk level ratings after implementing controls?

Answer 1

The data owner is the one accountable for protecting their data. They usually have management positions in the company and have both the resources and authority to make operations run.

Most of the time, the data owner will delegate to the data custodian the protection of the data (and associated information systems.) The data custodians will then be responsible to ensure all the adequate security controls are implemented and operating correctly.

The security professional will be tasked to monitor, evaluate, and report on these controls. They may also be responsible (with other stakeholders) to evaluate risks and help come to a decision on how each one should be managed.

You may see that risks below a certain threshold may be directly managed by the security professional. However, when risks are important, they are usually raised to the data owner.

This is the big picture, each organization has to decide on their own policy about how risks should be assessed and managed.