Risk takes different forms and so must risk identification, evaluation and mitigation processes. Typically, risk management is proactive and responsive. This, therefore, begs the question: who should handle risk in an organisation, and how should they go about it? Central banks answer this question in many different ways.

The 2023 update to the UK’s Orange Book puts the responsibility of risk management in the hands of the accounting officer. Although the document specifies a collaborative