Who Owns the Risk?

When a risk becomes visible, the first useful question is who has the authority and responsibility to respond.

Consider a fictional chilled-food delivery that arrives outside the organisation’s approved conditions. The receiving team records the result and holds the goods under its procedure. A quality specialist assesses the relevant criteria. An authorised manager decides the response within delegated authority. Internal audit may later examine whether the process, evidence and oversight were adequate.

The roles contribute to the same business objective, but they do different work.

Risk ownership and control operation

The accountable manager owns the response to the exposure within their remit. A receiving supervisor may own a specific check, while a different manager owns the broader delivery outcome. Assigning an employee to record a temperature does not automatically give that employee authority to accept the resulting business risk.

For the fictional case, make the handoff explicit: who can stop release, who can authorise disposition, what evidence is required and what must be escalated? Use the entity’s actual requirements and qualified judgment. This example provides no product-specific temperature or food-safety instruction.

Specialist challenge and governing-body oversight

Quality, risk and compliance roles can provide expertise, monitoring and challenge. Management still needs to act on the information. The governing body sets expectations and oversees accountability through appropriate information and challenge. It does not perform every receiving check.

A practical discussion becomes clearer when the organisation identifies the decision, the person authorised to make it and the information they need, rather than putting every responsibility under a department name.

Internal audit’s contribution

Internal audit provides independent, objective assurance and advice. It may examine whether controls and decisions are supported by suitable evidence and recommend improvements. It should not quietly become the person who accepts management’s exposure or releases the goods it will later review.

The IIA’s 2026 Three Lines Model recognises that organisational arrangements can overlap. Clear responsibilities, transparent reporting and safeguards against self-review matter where roles are combined. Independence does not require avoiding useful discussion with management.

A question for the next meeting

Take one recent exception in a process you understand. Write down the risk owner, control operator, specialist adviser, oversight body and independent assurance provider. Then name the decision that remains unresolved.

If everyone has a role but nobody can authorise the next action, the accountability arrangement needs attention.

Inside Assurance connects governance concepts with the decisions people make in a business.

Beyond the numbers. Inside the business.