If you work with a risk register, you've probably noticed one name showing up in the owner column over and over: security. In this episode, Professor Simon explains why that happens, and why identifying and documenting a risk isn't the same as owning the decision about it.

He walks through four roles that tend to get blurred together in one column (risk identification, risk ownership, remediation ownership, and acceptance authority), works through a concrete example of an unsupported finance application, and covers what security still has to do, what every healthy register entry needs, and how leadership should handle risks that stay open past their dates.

In this episode you'll learn:

- Why security's name ends up in the owner column, and why that stalls risk decisions

- The difference between identifying a risk and owning the decision about it

- A simple test for finding the real risk owner: who can say yes to the money, the downtime, or the exposure

- Four roles to keep separate: risk identification, risk ownership, remediation ownership, and acceptance authority

- What security still has to do: rate risks consistently, explain them, track dates, follow up, and verify remediation

- What a healthy register entry needs, and how leadership should handle risks that stay open

▶️ Companion YouTube Video: https://youtu.be/sUgPk7X6CCI

📝 Companion Blog Post: https://professorsimon.com/blog/risk-register-owner-who-decides

🎧 More Podcast Episodes: https://professorsimon.com/podcast

🧭 Figure out which cybersecurity path fits you: https://careervectors.com

🔗 Resources, blog & more: https://professorsimon.com/links

🌐 Website: https://professorsimon.com

💼 LinkedIn: https://www.linkedin.com/in/leonardsimon

📸 Instagram • X • TikTok: @profsimononline

If you found this episode helpful, please follow the podcast, leave a rating or review, and share it with someone who would benefit.