Who actually owns a risk once it's on the register?

Every troubled programme I have inherited had a risk register, and every one of them had the failure already written down on it. The risk was visible. What was missing was an owner who could actually do something about it.

A name in the owner column is not ownership. Ownership means three things. The person can see the risk clearly, they have the authority to act on it, and they carry the consequence if it lands. Take any one of those away and you have a label, not an owner.

The most common gap is authority. A project manager is named against a risk that only the sponsor can resolve, because resolving it means more money, a later date, or a hard conversation with a vendor. The manager updates the register diligently and changes nothing, because the lever isn't theirs to pull.

The second gap is consequence. When the same risk sits open month after month with no change, that is usually a sign that nobody in the room actually loses anything if it materialises. Risks that hurt someone specific get worked. Risks that hurt "the programme" drift.

I treat the register as a list of decisions waiting to happen, not a list of things to watch. For each live risk I want to know the single decision that would close it or reduce it, and the one person who can make that decision. If I can't name that person, the real risk isn't on the register at all. It is that no one owns it.

For an executive, this is a fast diagnostic. Open the register, pick the three worst risks, and ask who can actually move each one. If the answers are vague, your exposure is larger than the document suggests.