Welcome, and how this works
Jump around freely. Use Contents at the top right to revisit any section at any time, including after the assessment.
Prefer to listen? Most browsers can read this page aloud: right-click and look for Read aloud or Speech, or check your browser’s main menu.
This course takes about 45 minutes. You can stop at any point and pick up where you left off.
It is for anyone who has been named as the owner of a risk, or is about to be. Superintendents, managers, senior operational people and executives. It assumes the risk in question is a serious one, the kind your organisation would call material.
The definition the whole course rests on
A risk owner is the person with the accountability and the authority to manage a risk.
The definition comes from ISO 31000 and the risk vocabulary that accompanies it.
Both halves. Accountability without authority is nominal ownership, and it is the most common way this fails. Unit 8 deals with it directly, because it is usually a problem with the organisation rather than with the person.
What it covers
- What a risk owner is, and how that differs from a control owner
- The things you are accountable for, and the things you are not
- Knowing your risk well enough to own it
- Assigning critical controls, and what a Critical Control Performance Standard has to contain
- Verification, and what to do with what it tells you
- Accepting residual risk, escalating and reporting honestly
- Authority: what you need, and what to do when you do not have it
- The ways risk ownership reliably goes wrong
Before you start
This course assumes you already know the vocabulary: the risk management process, the hierarchy of control, what makes a control critical and roughly what a bow tie shows. If any of that is unfamiliar, take Introduction to Risk Management first. It is free, it takes 40 minutes, and it was written to lead into this one.
What it is not
General guidance on the accountability, not legal advice, and not a replacement for your own organisation’s risk framework, which will use its own terms and thresholds. Being a risk owner is an organisational accountability. It sits alongside whatever legal duties apply to you and does not replace them.