add some analysis. what will be the consequences of failing to introduce the alleviating factor?

Restricted access to essential personnel only.The security risk analysis process is to characterise the threats. This is a difficult process which requires an understanding of the environment and context in which the enterprise exists. It is sometimes the mere existence of certain assets that create and attract a threat. (U1, p14)

Analysis: A risk owner is defined as a person with the accountability and authority to effectively manage the risk. (WRMT, p7) Identification of asset owners are essential in assisting with the characterisation of threats at the earliest opportunity. For example, there is an IT risk identified at the facility but with the assistance of that asset owner at the early stages they can confirm the following is carried out.

1. Provide assurance that the risks for which they are the risk owner are being effectively managed. (WRMT, p9)
2. Take ownership of the action they are responsible for by either confirming the existence and effectiveness of existing actions or ensuring that any further actions are implemented. (WRMT, p9)
3. Can identify who needs access to what information and place encrypted passwords on key equipment to restrict the number of employees gaining needless access to key information.

The above is just one example of how including the asset owners for each asset is vital when it comes to understanding the threat against it, then implementing robust mitigation measure to ensure the alleviating factor is in place.