Domain 2 · Objective reference 2B2 · Chapter 11 of 35
Assign risk ownership and control accountability
About 5 minutes · Detailed public baseline effective 2022; the replacement exam starts 3 November 2026 and its exact revised topic/task mapping remains unverified
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: The person fixing a control may not own the business risk.
Explore the anchors
Decide treatment and residual acceptance.
Concept matching activity
Match this task or description to its concept:
Deliver and operate the safeguard.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Management concept and decision mechanism
- Make acceptance an explicit decision
Management concept and decision mechanism
A risk owner is accountable for the business decision about an exposure within delegated authority. A control owner is accountable for ensuring a safeguard is designed, operated and monitored; control operators perform specified activities. These roles interact but are not automatically interchangeable. Record decision thresholds, escalation, dependencies and reassessment triggers. Where services are shared, identify whose consequence is being accepted and who can decide on it. Outsourcing control operation does not remove the customer’s need for accountable oversight of retained exposure and obligations.
Make acceptance an explicit decision
Acceptance requires the appropriate authority, an understood exposure, and a record of the decision. The fact that a risk has remained open for months does not mean it has been accepted. Define the scope, rationale, expiry or review condition, and the party authorized to reconsider it.
Risk appetite expresses the general amount and type of exposure the organization is willing to pursue or retain. Tolerance establishes more specific boundaries for objectives or activities. Local terminology varies, so use the organization's approved definitions. Escalate decisions beyond delegated limits.
Worked example
A hosting supplier operates a security control, but the customer service owner remains responsible for deciding whether its residual outage exposure is acceptable.
Check your understanding
Why should a remediation ticket identify more than the technical implementer?
Show explanation
The implementer may not own the business consequence, funding or acceptance decision needed to resolve the exposure.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.