Last updated:
Who owns risk in CISM scenarios?
Executive Summary & Key Takeaway
Security managers advise and manage the security process. Risk owners make accountable business risk decisions. The best CISM answer often turns on that difference.
According to ISACA, CISM includes governance and risk management domains. Those domains require candidates to distinguish security management responsibility from risk ownership and business accountability.
This guide calls this Governance-Owner Confusion. It happens when the candidate knows something must be done but assigns approval, acceptance, or accountability to the wrong role. In CertArc, the closest reason to tag is “Answered as technician, not manager”.
Verified official source: ISACA CISM Exam Content Outline
CISM Answer Trap Translator
| Trap | Why it feels right | Stronger managerial lens |
|---|---|---|
| Security Owns Everything | Security teams understand the issue and feel responsible for fixing it. | CISM separates security advice and execution from accountable business risk ownership. |
| Expert Signs Off | The person who understands the risk best seems like the right person to accept it. | Accepting a risk needs authority over the business objective it affects. Expertise informs that decision but does not carry it. |
| Control Owner Equals Risk Owner | The team that runs a control seems responsible for the risk the control manages. | Control owners operate controls. Risk owners decide whether the exposure that remains is acceptable. |
| Reporting Means Owning | The security manager reports on the risk, so the risk seems to be theirs. | Reporting keeps the owner informed. The owner answers for the decision. |
| Blocking as Protection | Stopping the activity looks like the safest available choice. | Halting a business activity is a business decision, unless a policy gives security that authority for the named condition. |
Who decides, who advises?
Organizations name these roles differently, but CISM scenarios follow a stable pattern. Find the decision the question is asking about, then find the role with authority over it.
| Decision | Who makes it | Security manager's part | Tempting wrong answer |
|---|---|---|---|
| Accept a risk within appetite | The risk owner: the manager accountable for the business objective the risk affects | Assesses the risk, documents the rationale, records it in the risk register and sets a review date | Security accepts it because the gap is technical |
| Accept a risk above appetite | Senior management or the board committee that set the appetite | Frames the choice: treat the risk, or revise the appetite | The risk owner signs off alone |
| Choose a treatment option | The risk owner | Recommends options, with the cost and expected residual risk of each | Security picks the strongest control |
| Approve a policy exception | The authority the policy names, with the risk owner accepting the exposure | Assesses the gap, proposes compensating controls and tracks the expiry date | Security grants the exception informally |
| Operate the control | The control owner, often IT or operations | Sets the requirement and checks that the control works | The risk owner is expected to run the control |
| Set risk appetite | The board, or the committee it delegates to | Supplies risk information and metrics | Security sets the appetite |
Worked scenario: the launch sign-off
A regional sales director plans to launch a customer self-service portal in three weeks. The information security manager’s assessment finds that the portal’s password-reset flow lets someone take over an account with only an email address and a date of birth. The fix will take six weeks. The sales director asks the security manager to “sign off on the risk” so the launch can go ahead. What should the security manager do?
- A.Sign the acceptance, since the security manager understands the risk best.
- B.Block the launch until the password-reset fix is in place.
- C.Take the assessed risk and the options to the sales director, and record the decision.
- D.Start the fix in parallel and launch on the original date as planned.
C is the strongest answer. The portal and its revenue belong to the sales director, so the decision does too. The security manager’s value is a clear, costed choice: delay, launch with compensating controls such as extra verification on resets and closer monitoring, or accept. Each option comes with its residual risk, and the decision is recorded at the authority level the appetite requires.
Why A feels right: the security manager is the expert. Expertise does not give authority over a sales objective, so a signature here would be an acceptance by the wrong role.
Why B feels right: it protects customers. Stopping a business launch is a business decision unless a policy gives security that authority.
Why D feels right: it is action-oriented. It leaves a known gap open for six weeks with no owner decision and no record.
What would change the answer: if the risk is still above appetite with compensating controls in place, the sales director cannot accept it alone, and the decision goes to the level that set the appetite. If a policy gives security a veto for a named condition, such as regulated data without a required control, blocking under that policy becomes stronger. The authority then comes from the policy, not from the security manager’s opinion.
How this differs from the neighboring traps
Residual risk. The residual-risk trap is about the risk left after a control is applied. This page asks an earlier question: who has the authority to make the risk decision at all. The two meet at acceptance. The risk owner accepts residual risk within appetite, and anything above appetite goes higher.
Policy exceptions. An exception is one specific decision on this map. The authority the policy names waives a requirement, and the risk owner accepts the exposure that creates. Exception questions usually test the approval path and the expiry date. Risk-owner questions test who carries the business consequence.
Board versus management. Board questions are about level. The board sets direction and appetite and oversees, while management runs the business within them. Risk ownership sits inside management, with the manager whose objective is at stake. The board is the answer only when the decision changes appetite or strategy.
Cues in the question
Decision verbs such as accept, approve, sign off and decide point to an ownership question. Look for the role with authority over the affected objective. Verbs such as implement, configure and deploy point to the control owner. Assess, recommend, report and monitor describe the security manager’s part. When an option gives a decision verb to the security manager, check whether the scenario actually gives them that authority.
How CertArc uses this
CertArc CISM Lens explanations call out whether a miss came from assigning risk ownership, control execution, or management accountability to the wrong role.
Why this distinction matters
Ownership questions punish a habit that makes security people good at their jobs: taking responsibility. The exam rewards knowing where your authority ends and handing the decision, well framed, to the person who owns it.
Common approaches that fall short
- Role definitions alone do not show which role a scenario is asking about. The cue is usually the decision verb.
- Org-chart answers such as “the CISO owns security risk” break down when the question is about the exposure of a business process.
- This page adds a decision-by-role table and a worked scenario, so you can practice the ownership call instead of memorizing definitions.
Related questions candidates ask
- Who should accept risk in a CISM scenario?
- What is the difference between a risk owner and a control owner?
- When does a risk decision go to the board?
- Who approves a policy exception?
- Can a security manager stop a business launch?
Related guides
Risk Owner vs Security Manager FAQ
Can security own risk?
Security can own security processes and recommendations, but business risk decisions usually belong to accountable business or management owners.
Why does risk ownership matter in CISM?
Because many plausible answers fail by assigning approval, acceptance, or accountability to the wrong role.
How does CertArc detect owner confusion?
CertArc practice and CISM Lens explanations help you recognise Governance-Owner Confusion and review the decision role, not only the topic. This is a review framework, not an automatic diagnosis.
Can the CISO be the risk owner?
Yes, for risks to the security program itself, such as its own budget or tooling. For the risk to a business process, the CISO advises and the business manager who owns that process is the risk owner.
