Risk Management Should Drive Organizational Accountability

Elliot Volkman

by Elliot Volkman

October 14, 2022
Ownership and accountability for risk doesn’t belong to the GRC or ERM team. Drata's CISO shares his view on who owns business risk.

Who owns the decision to accept the risk? In the view Drata’s CISO, Ross Hosman, it’s not the governance, risk, and compliance (GRC) or enterprise risk management (ERM) teams. 

In his recent on-demand webinar about measuring your risk management program’s effectiveness, Ross explains his take on risk ownership—and accountability. You can go watch the full video here, but if you’d like a snapshot of his take keep reading. 

Determining Risk Ownership

Early in the webinar, Ross introduces the concept of risk owners and risk acceptors. Neither of these roles belongs to the GRC or ERM teams. The responsibility for accepting and owning risk falls on the company’s leadership—the people whose decisions create that risk. They must own the consequences of their decisions and ensure the business only takes appropriate risks.

Without executive accountability, risk ownership falls on the GRC or ERM teams—even though they lack the authority to change the business.

When and How to Accept Risk

GRC and ERM teams can only manage risk. They may even reject decisions that expose the business to unacceptable risks. But they do not own the risk.

Risk managers must assess a risk based on its impact on the business and present their conclusions to the executive team. Accepting a high-impact risk is not possible. Instead, the risk owner must take responsibility for transferring, mitigating, or fixing the risk.

Accepting a low-impact risk depends on the executive team’s risk tolerance. But it’s still an executive decision, and they are accountable if that risk causes an incident.

Measuring the Effectiveness of Risk Management

Understanding the business perspective of managing risk is only one piece of the puzzle when it comes to measuring how effective a risk management program is. To learn more, watch the full on-demand webinar with Drata's CISO. 

If you’re looking to improve and automate your risk management program, schedule some time with our team and see how Drata can help you stay ahead of potential threats.

The Drata Newsletter

Trusted is Drata’s newsletter focused on the world of compliance, security, data privacy, and everything in between.


The Drata Community

Screen Shot 2022-07-13 at 9.45 1
Resources for you
G2 Reports Social LinkedIn 1200x627@3x

Drata Named a Cloud Compliance Leader in G2 Spring 2023 Reports

Media - Drata's Continued Support of Auditor Alliance

Drata’s Declaration of Continued Audit Independence

4 States Cybersecurity Laws

4 States Passed Nearly Half of All New Cybersecurity Laws Enacted Across the US in 2022

Elliot Volkman
Elliot Volkman
Director of Brand, Content, and Community