Where should risk decisions be made according to risk management principles?

• A. At the right level.
• B. At the lowest level only.
• C. At the highest level only.
• D. By external authorities.

Answer: (A)

Risk decisions should be made at the right level—where the risk owner has both the necessary context and the authority to act within the organization’s risk appetite. This placement ensures decisions are timely and grounded in real-world information, while still aligning with governance and resource availability. If decisions are left to the lowest level only, there can be misalignment with overall risk limits and insufficient authority to address broader implications. If they rely solely on the highest level, responses may be slow and out of touch with on-the-ground realities. External authorities aren’t the source of internal risk ownership or day-to-day decision-making. So, the best approach is to empower the appropriate level with the ownership and authority to manage risk effectively within the defined risk appetite.