A Risk Nobody Owns Is a Risk Nobody Is Treating.

There is no useful such thing as an unowned risk. There are risks with named owners and risks drifting without accountability. When you leave a risk unassigned, you have not controlled the decision. You have left it to inertia. The risk sits in your register, quietly untreated, and the organization goes on operating as if it were fine.

That can look like acceptance from the outside, but it is weaker than deliberate acceptance. Deliberate acceptance has a record: someone weighed the exposure against the cost and decided to carry it. An orphaned risk has no such decision. No one was on the hook to do anything, so nothing happened. The practical outcome may be the same, the risk remains open, but the governance position is worse because nobody can show who made the call.

A risk register is not a decision. It is a list. The decision happens when a named person looks at a specific risk and picks a path. NIST defines risk response as intentional and informed decisions and actions to accept, avoid, mitigate, share, or transfer an identified risk. Those are the levers, and every one of them requires someone with the authority and the accountability to pull it.

Accept means you understand the exposure and choose to carry it. Avoid means you stop or redesign the activity. Mitigate means you commit to controls that bring it down. Share or transfer means another party carries part of the consequence through insurance, contract, outsourcing, or another mechanism. Each of those is an active choice with a name attached. None of them happens on its own.

Strip out the owner and you strip out the choice. The risk cannot mitigate itself, cannot buy its own insurance, and cannot decide it is worth carrying. It just sits there. That is why ownership is not administrative overhead on top of risk management. Ownership is what turns risk management into action. Everything else is documentation.

The confusion is rarely about whether a risk matters. It is about who owns it. The IIA's Three Lines Model, the 2020 update to the old three lines of defense, is clear on the split. Management's responsibility to achieve objectives includes first and second line roles. First line roles are most directly aligned with delivering products or services, while second line roles provide complementary expertise, support, monitoring, and challenge. The IIA also says responsibility for managing risk remains part of first line roles and within management's scope.

Read that carefully, because organizations get it backwards constantly. Risk does not simply belong to the risk team. The risk team helps the organization manage risk with expertise, support, monitoring, and challenge. The risk itself sits with the business activity that creates it, benefits from it, and can actually do something about it. When ownership drifts to a central function that has visibility but no operational control, you get a register that looks managed and a business that may not be acting.

A named owner in the first line is not a formality. It is the difference between a risk somebody can act on and a risk everybody can point at. If you are serious about closing the gap, start by making ownership explicit in your risk management process instead of assuming it will sort itself out.

Start with the risks that have no real person attached. Filter the register for blank owner fields, shared inboxes, former employees, committee names, and owners who have not touched the item in a quarter. Those are not just administrative defects. They are signals that treatment may not be happening.

For each orphan, record five fields before the day ends: one accountable owner or role, one reviewer, the treatment path, the treatment due date, and the escalation rule if the date slips. If the business cannot name that owner, the risk is not ready for a dashboard. It is ready for escalation. That is the practical line between a risk someone manages and a risk the company may be carrying by accident.

Nobody sets out to leave a risk unowned. It happens through ordinary organizational drift. A risk gets logged in a meeting and the note never names a person. An owner leaves the company and the assignment never transfers. Two teams each assume the other has it, so neither does. A risk sits across a boundary that no single leader controls, and it falls into the gap between them.

The RACI or RASCI model exists to reduce this ambiguity by naming who is Responsible, Accountable, Supportive, Consulted, and Informed. KPMG describes it as a way to define and document roles and responsibilities so responsibilities are explicitly owned. The one that matters most here is Accountable: if that slot is empty, assigned only to a shared inbox, or buried in a committee with no named decision-maker, accountability evaporates. A risk owned by everyone is often owned by no one.

The pattern is always the same. The risk did not disappear. The accountability did. And an accountability gap can read, in practice, like a decision to carry the risk without saying so.

Deliberate risk acceptance is defensible. Silent acceptance is not. When a named owner formally accepts a risk, there is a record. Someone can point to the reasoning, the tradeoff, the sign-off. If it goes wrong, the organization can say it saw the exposure and made a call. That is governance working.

An orphaned risk gives you none of that. There is no reasoning because there was no reasoner. There is no tradeoff because no one weighed it. If it materializes, there is no story except that everyone assumed someone else had it. Regulators, boards, and customers are unlikely to treat that as a serious governance answer, because it is not an answer. It is an absence.

The cost is not just the incident. It is the discovery, after the fact, that the risk was known, logged, and then quietly abandoned. A documented decision to accept can be defended. A gap where a decision should have been cannot.

The division of labor is simple. A system's job is to make sure every risk has a named owner and to track whether that owner acted. A human's job is to decide what to do about it. The failure is often not a human refusing to decide. It is the operating system letting risks exist without forcing the question of who owns them.

A risk with no owner should not be able to sit quietly in your register. It should surface, loudly, as an unresolved question: who is accountable for this, and what did they decide? That is work a system should do relentlessly, because humans forget, reorganize, and move on, and the register does not chase them.

We built Sorena around that split. Every risk carries an explicit owner. Unowned and untreated risks do not blend into the list, they stand out as gaps that need a decision. The system holds the accountability so it cannot quietly evaporate, and it keeps a record of who decided what. The judgment stays with your people. The tracking does not rely on memory. That is the only way ownership survives a real organization instead of drifting back into the gaps.

Go back to your risk register and look for the blanks in the owner column. Each one is a risk you may be carrying without evidence that anyone chose to carry it. You did not decide to accept those. That is worse, not better, because an accepted risk at least had a decision behind it. An orphaned risk had none, and it is exposed all the same. Ownership is what makes the decision possible. Assign it deliberately, track it relentlessly, and let your people make the call, or drift will keep making it for you.