As far as I know "risk owner" is a term used in insurance industry for the customers of insurance companies.

a Risk owner in building and facilities management is the person who is responsible for controlling or mitigating the identified risk

Our group is doing work on risk ownership with respect to disasters. It is a difficult and fluid concept in that environment, not least because of the idea of risk sharing. That work is in progress where we intend to develop some solid guidelines. 

From a 2013 report on adaptation to climate change (slightly edited): The major filters for managing risks at the institutional scale are: who values the risk and who owns the risk – the latter can be separated into who is responsible for the risk, who pays compensation for the risk if it occurs, and who pays for managing the risk. Ownership may be invested in a single entity but often extends across institutions and domains. Valuation methods need to be appropriate within specific institutional contexts.

These will be teased out more in the current work.

Ufuk Turen,

Thank you for this hint. I have looked it up at Google Scholar, and it seems to me, even if this is not completely clear, that it is used as a behavioural economic tool.

Insurance, though by many perceived as a real economics tool, it primarily considered a behaviuoral economics component. As traditionally insurnce is not seen as something that effect the outcome of an investment. Insurance is something that you can apply, if you feel like it (I know that insurnace also has an effect in increasing will to invest, but this also does not chance the outcome of an investment, and the "will to invest" is also a behavioural thing).

Only recent studies have managed to show that insurance can indeed change the total economic outcome of an investment.

Thus when I read risk owner in insurance theory, I read someone that feel compelled to take out an insurance for a given risk. In enterprise risk management, this would typically be at a top organisational level. Cheif Risk Manager or CFO.

I will read up some more on this and thank you for the hint,

Jesper

Joel,

Are you refering to the the ISO 31000 RM system, and do you differentiate between technical risk and enterprise risks in that setup?

Jesper

Roger Nerville Jones,

This is extremely interesting to read. Have you considered that your disaster focus may be highly relevant for corporate settings?

Most corporate risk processes has an ERM basis, in that they are in place to prevent "economic disasters" in the shape of sudden drain on capital or sudden drop in earnings.

Leanings from such "economic disasters" of which we have just had one in Denmark where a company OW Bunker was declared bankrupt shortly after a spectacular stock marked introduction (IPO), is that it is difficult to place a responsibility.

We don't know who the risk owner was, and everyone points at each other. Only in the case that something criminally has taken place will we be able to fix a responsibility to someone. My point is that in corporations risk ownership is as fluid a concept as in disaster management.

I'm tentatively working with a risk ownership definition, centering on reserves. Meaning that risk ownership has to be linked with reserves. If risk ownership can result in sudden capital requirements, or loss of financial strength, the risk owner has to be the one owning the reserves.

In this respect at a large corporation, a risk owner is the CFO, of this person controls all the reserves. But the risk owner can be a project manager of a construction project, if this person has allocated specific reserves to the project. This project manager, will then typically only be asked to manage certain risks within the reserves, and other risks (uncertainties) will still be the ownership of an executive i.e. the CFO.

The definition has the advantage, that reserves are finances, and no one grants anyone finances with out specifying their use. And in my mind, giving someone ownership for a risk, but not the financial muscle to manage the risk is a false ownership, and one that is often used.

The question is if this definition has any application in a disaster setting. I know too  little about this, but intuitively the work should be align able.

In my mind, the definition you propose above has the problem, that I can assume (or be assigned) a risk ownership that is proforma. I.e. one I cannot manage, and there by I will end up sending the bill to someone else, who will then turn out being the real risk owners. I.e. I can take the responsibility for a flood, but I will never be able to meet the financial requirements of an actual flood, and the bill will therefor go to the house owner or the state. If I on the other hand have a reserve of credible size, I can take the risk ownership and be a credible "risk owner", as opposed to some one who has been assigned the risk responsibility, but is not a "Risk Owner".

Jesper, thanks for the response. Yes, we have considered it for corporate entities. What I have above is not a definition per se. We want to understand the system(s) better before we would hazard a comprehensive definition. That takes into account many of the (excellent) points you have made. Some areas of ownership are explicit and may be legally prescribed. Others are implicit and may or may not be embedded in social contracts, which are not fully understood. The one thing we would like to do is to identify unowned risks and ask whether or who, should own them. False ownership, as you call it, is also important.

Whether the disaster setting is natural or human (e.g., financial) should not make a large difference except in the detail of ownership that is explicit, implicit or ignored. The broad setting is institutional and the theme is risk governance.

Roger

If you take it to a coprorate setting, you will likely encounter a problem: in financial reserves not existing as an economic tool (except as a core capital in banks).

This is at first puzzeling, but on closer examination, it is the result of risk being defined as:

Risk = probability x consequence

In this definition reserve capital plays no role.It will not impact the economic risk description.

So to define a risk owner, you must define reserve capital first. This is a monumental task to make a new definition in Economics.

Unless your risk owner you work with is consequence free on the risk outcome.

Hi Jesper,

Interesting question and slippery. I have worked a lot with industry prior to being in research and l think there are a number of other layers. Being accountable is not always the same as being responsible and this becomes very complex when there are multiple owners. There are certain premises in areas like banking where there are assumptions such as too big to fail,  that raise interesting questions as to whether this leads to poorer risk management because you are buffered to some degree from the consequence and so never have to fully own the risk..

I agree that we should look at banks in this discussion, as that are the center of much attantion with respect to risk.

The financial crisis showed that certain banks, though declaired riskowners, were in fact not owning the risk. As the risks materialised the responsibiliy ended up some where else.

The result were the financial stress test system, that were imposed on the banks by the governments. Such as the BASEL II setup.

But interestingly the stress testing has today been adopted as most banks as being a tool that provides meaningfull information.But only after they were forced to do it.

I see a financial stress test as a test of risk ownership. Your ownership of a risk is no greater than your ability to absorb the consequence of the risk.

The "too big to fail" situation I see as a realisation that has led to an increased understanding of a "risk owner". I agree that if the "too big to fail", if it is not followed up with a stress testing and audits, will lead to a flawed decision process. However with the correct setup, increasing risk management will lead to decreasing need for reserves, which will promote risk management.

In a sense the lack of definition of a "Risk Owner" has led to all industries assuming ownership over risks, that they do not truely own. In banking we now have experience in being more accurate in defining the extend of ownership over a certain risk. I think we could benefint from extending this insight and practice into other industries.

I see a lot of confusion in your questions. It is plain and simple!

From Project Management point of view, 'Risk' is any uncertain event or condition that can have either positive or negative effect on the project. 'Risk Owners' are individuals or entities that are responsible for monitoring and responding to an identified risk within the project.

I don't see any relationship between being a risk owner and access to reserves. For example, I could go ahead and ask you which reserve you're talking about. Is that 'contingency reserve' or 'management reserve'? They are nothing to do with risk ownerships! What if a risk was a 'positive' risk? Why would you need to access the reserve in this case?

Dear Pandi-Perumal

Thank you for your comment, and I can asure you that there is less confusion in my question than you think.

By definition, a reserve is an unallocated liquid capital, that is expected to be used to cover future expenses: http://financial-dictionary.thefreedictionary.com/Reserve

The subdevision of reserves you refer to is a management decision on the internal corporate capital structure, and that is completely irrelevant for the question.

The definition of "risk" you refer to is the typical iso 31.000/PMI definition, but it is not the financial definition. In finance risk is a negative outcome of an investment.

http://www.investopedia.com/terms/f/financialrisk.asp

As reserves are a financial tool, it should refer to the financial definition of risk.

So the problem is still intact: Risks identified in ISO 31000/PMI processes is not linked with the financial definition of risk, and people can accept risks (as in financial risks) for wich that have no reserves to cover. In this way they can be a ISO 31000 risk ovner, but fail in being a financial risk owner.

This whole problem comes from not having any known definition of a risk owner.

Sorry, I didn't realize that you're talking about the financial definition of the risk, in which the risk owners could also include 'project managers' as per your original post suggests. You used 'project' and 'project manager', which will lead to misinterpretations. In project management perspective, a risk can be positive or negative. If it is positive, you accept it. In financial terms, what is the scenario, if certain financial leverage makes sudden 'profits' (ROI or ROE) rather than 'loss'. Would such profitability be considered as a 'risk'? In any case, from my point of view, the 'shareholders' bears most risk.

Thanks Jesper Lyng Jensen for this very relevant question.

Risk ownership is an extremely nebulous concept, less so in the modeling domain than in reality. I have found that it equates conveniently to "stake holder", which is equally hard to define. When is a stakeholder a risk owner? Usually not if you define "stake" in a non-risk way, such as a stakeholder being an entity in need of information as input in a decision-making process (possibly to manage risk - to introduce a self-referential element).

As risk owners are a rare species in the corporate ecosystems there is a tendency to link the managing of risk to the business process owners, but in my view any choice comes down to a governance matter. Putting the durability of such frameworks to test.

Revisiting this question, another proposal emerged. In ISO31K risk is defined as the effect of uncertainty on the achievement of objectives. An obvious initial definition for risk owner should derive from those objectives, i.e. the entity responsible for accomplishing the objective owns the management of any accompanying (known) risk. 

Thank you for your comments Peter

I have no experience with using the ISO 31K definition for this purpose, but I could be worried that the definition is too diffuse to be used to define risk ownership. Overlapping objective through the chain of command would make it dificult to place ovnership at a given level. 

I still think that the best way forward is to use cost effect relative to the risk owners reserves to define ownership.

By this definition, if you as a risk owner contain more risks than you have reserves to manage, you are not the risk owner. And ovnership of some risks should be transferred to whoever has the reserves to cover the risk cost. Alternatively more resoures has to be added to the risk owner.

While this definition is not perfect, It give us something fairly tangible to discuss ownership from.

So basically a risk owner must be able to make a financial stress test (or a simulation), to document that risk ownership is intact, as you cannot own a risk you cannot manage financially.

Through this process risks that superseeds the financial capabilities of the risk owner will travel upwards the chain of command, until someone can accept it. Which is what we want to happen.

The RISK OWNER is the sponsor or champion of project along and success or failure will be counted in his/her account and will be fully responsible.

A risk owner may not be associated to a project. Perhaps more suitable to define the risk owner as the entity that is assigned responsibility for executing the strategic objectives that carry the specific risk. I think that would cover the business process owner as well as the project champion, plus more.