“Risk is a measure of the extent to which an entity is threatened by a potential circumstance or event, and is typically a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence.”National Institute of Standards and Technology (NIST) · Guide for Conducting Risk Assessments (NIST SP 800-30 Rev. 1) · 2012 · NIST SP 800-30 Rev. 1, «Guide for Conducting Risk Assessments» (septembrie 2012), secțiunea 2.3 «Key Risk Concepts»
A risk owner is someone who can allocate budget and stop an activity, not someone who keeps a register.
The definition in the NIST risk assessment guide (SP 800-30 Rev. 1, 2012) is useful precisely because it is dull: risk is a measure of how far an entity is threatened by a circumstance or event, as a function of adverse impact and likelihood of occurrence. ISO 31000:2018 says the same thing differently — the effect of uncertainty on objectives — and adds what the first phrasing lacks: risk is measured against objectives, not against assets. Three terms get confused constantly. Risk appetite is how much risk the organisation seeks in order to reach its objectives; it is a board decision, not a security team decision. Tolerance is the accepted deviation around that appetite, expressed as concrete thresholds that trigger a reaction. The risk owner is the person with the authority and accountability to treat it, meaning someone who can allocate budget and stop an activity. In ISO/IEC 27001:2022, clause 6.1.3 requires owners to approve the treatment plan and accept residual risks.
The step the card does not take yet is this: without written objectives, risk cannot be measured, because there is nothing to measure it against. NIST gives the formula, ISO gives the anchor — the effect of uncertainty on objectives. In practice, you first ask what the organization wants to achieve, then what could stop it. An online shop wants 24-hour delivery; so a courier outage is a risk, while a failure on a test server is just an event with no stake. The same failure becomes risk only when it hits an objective. Everything else follows from this: appetite, tolerance and the owner only make sense against that objective. But how does an organization decide how much risk it is willing to accept for its objective?
Passage 2: The answer to that question is risk appetite, and it is a leadership decision, not a security team's call. The board effectively states how much failure the organization can absorb on the way to its objective. Tolerance then translates appetite into concrete thresholds: if deliveries slip past eight hours, someone must react. Without a threshold, appetite stays a nice slogan on a poster. And thresholds without a named person who reacts remain just numbers on paper. Who should sign that name?
Why it matters The auditor does not ask which risks you have but who owns them and who accepted the residual risk; without names, clause 6.1.3 is not met.