Exam CRISC topic 1 question 1704 discussion

The risk owner has ultimate responsibility and accountability for managing specific risks, including decisions about risk response strategies (accept, mitigate, transfer, or avoid). Therefore, the risk owner is responsible for approving the costs of controls because they: Understand the business context and risk implications. Have the authority to allocate resources necessary for mitigation. Are accountable for ensuring risk levels are within acceptable thresholds. Why not the other options? B. Control implementer: Implements controls but does not have decision-making authority on budgets or risk acceptance. C. Control owner: Responsible for operating and maintaining controls but not for authorizing expenditure or deciding risk response actions. D. Risk practitioner: Provides analysis, assessment, and advice on risk but typically does not have authority to approve costs or allocate funds.

control owner