From a basic understanding of risk management, a risk register records the risks of an organization, its mitigating controls, etc. Who has the authority to approve residual risk level ratings after implementing controls?

  • The answer to this is not limited to information security. This is a universal risk management question and concept.
    – schroeder
    Oct 24, 2022 at 9:27

1 Answer 1


The data owner is the one accountable for protecting their data. They usually have management positions in the company and have both the resources and authority to make operations run.

Most of the time, the data owner will delegate to the data custodian the protection of the data (and associated information systems.) The data custodians will then be responsible to ensure all the adequate security controls are implemented and operating correctly.

The security professional will be tasked to monitor, evaluate, and report on these controls. They may also be responsible (with other stakeholders) to evaluate risks and help come to a decision on how each one should be managed.

You may see that risks below a certain threshold may be directly managed by the security professional. However, when risks are important, they are usually raised to the data owner.

This is the big picture, each organization has to decide on their own policy about how risks should be assessed and managed.

  • Are you sure you want to tie this to the data owner and not the risk owner? Data or risk owners are not always involved in "making operations run". This is one way of looking at one part of the risks involved, but it is not a general answer.
    – schroeder
    Oct 24, 2022 at 9:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .