Establish risk ownership

Trigger: An IT risk is newly identified, updated, or flagged during periodic review as lacking a designated accountable party.

1. Identify the specific IT risk requiring ownership
2. Determine the appropriate role based on risk impact and domain
3. Nominate a specific individual or group for risk ownership
4. Obtain formal acceptance of accountability from the nominee
5. Document the assigned risk owner in the enterprise risk register
6. Communicate the ownership assignment to relevant stakeholders

Outcome: A specific individual or group is formally assigned, documented, and accepts accountability for managing the identified IT risk.