Risk ownership is typically assigned to individuals or departments directly impacted by the risk. The risk owner should have sufficient authority and knowledge to manage the risk effectively.