What it means
A manufacturer lists 'supplier failure' as a risk but gives ownership to 'management', so if a supplier's deliveries start slipping nobody knows who will investigate or raise a response. A named risk owner closes that gap.
The UK government's project-delivery guidance says each risk should have a named individual responsible for planning, implementing and monitoring the response, supported by action owners who do specific work, although this is practical governance guidance, not a universal legal mandate. Choose someone with a genuine route to act: a procurement lead may own the supply risk because they can review vendor performance and propose alternatives, whereas a junior clerk with no supplier contact or budget authority would be a poor choice even if they entered the risk into a register.
One clear owner per specific risk usually works better than a committee label, although several teams can still share actions. If a scenario spans finance, IT and operations, choose a person who can coordinate and escalate across those teams.
Define the risk precisely, because 'supply chain' is too broad to manage while 'sole supplier misses two monthly deliveries and halts production' has a trigger, impact and scope, and different supply threats may need different owners. The owner assesses likelihood, consequences and current controls with relevant specialists, so a finance leader may own the financial exposure but ask operations to estimate downtime.
Owning the risk does not confer technical expertise in every dimension. Approval should follow the organisation's risk appetite and delegated authority, so a risk owner cannot silently commit to an unbudgeted purchase.
Assign actions with names and dates, as when a quality engineer tests an alternative component while procurement seeks a contract, and check completion and whether the action actually reduces the risk. Monitor indicators such as late deliveries, falling cash balances or a rise in security alerts, and put thresholds in the register so escalation does not depend only on an owner's intuition.
Report residual risk after controls, since a backup supplier may lower the chance of an outage but not eliminate it, and leaders need to understand what remains and whether it fits tolerance. Distinguish an owner from a decision maker who accepts a risk above tolerance, because an executive or board may be required to approve acceptance.
The owner prepares the facts and recommendation, then follows the approved route. The UK guidance also warns against assigning too many risks to one person, as a register can show 100% owner coverage while one busy manager cannot meaningfully review fifty scenarios, so capacity is part of the assignment.
If an owner changes job, hand the risk over with controls, open actions, evidence and deadlines instead of leaving an old name on the register just because the spreadsheet has not been edited. A useful metric is owner coverage, but it is only a completeness test: if 27 of 30 register entries have a named owner, 90% coverage shows three gaps and does not prove that the other 27 risks are well managed.
In practice
Real-world examples.
Example
A procurement manager owns a sole-supplier failure risk and asks engineering to test a backup component. The manager keeps the register entry current and reports the result at each monthly review.
Example
A finance lead owns cash-flow pressure and escalates when the forecast balance falls below a set threshold. The threshold is written in the register, so the escalation does not depend on anyone's mood that week.
Example
A security lead owns a ransomware scenario while the board retains authority to accept residual exposure above tolerance. The lead prepares the facts and a recommendation, and the board decides.
Formula
Calculation
Ownership coverage = register risks with an appropriate named owner / all current register risks x 100.
Worked example. A fictional register has 30 current risks and 27 have an appropriate named owner. Coverage = 27 / 30 x 100 = 90%, which leaves three gaps to fill.
Now check capacity. If one manager owns 12 of the 27 owned risks, that manager holds 12 / 27 x 100 = 44.4% of them. Full coverage would look better on paper, but the concentration of work on one person suggests some owners need to change. Inspect the three gaps and the suitability and workload of existing owners before reporting the figure as a success.Case study
Seen in the real world.
This entirely fictional example concerns Oasis Foods, an invented manufacturer. Its register listed 'management' for supplier and cash risks. When deliveries slipped, no one had a response ready or knew the escalation threshold. The company rewrote each scenario, named a procurement or finance owner and assigned specific actions to specialists. It reviewed residual exposure at the next leadership meeting.
The case illustrates accountability, not a promise that ownership prevents all losses. Six months later a second supplier was late with a delivery. This time the procurement owner saw the trigger in the register, called the backup supplier within the day and told the finance owner what the extra cost would be. The disruption was smaller, and the leadership meeting reviewed the response instead of searching for someone to blame.
Watch out
Common mistakes.
- Assigning an anonymous team or an individual without access, time or a route to act.
- Expecting the risk owner to do every task or approve decisions outside their authority.
- Keeping a name in the register after the person leaves or the risk changes materially.
Questions
People also ask.
What is a risk owner?
A named person who manages a defined risk and its response, record, monitoring and escalation.
Should a risk have one owner?
One clear owner for a specific scenario is usually useful, while several people can own response actions.
Do they do all the work?
No. They coordinate and check the response, assigning actions to others within the approval structure.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%