The committee should find the information about who is responsible for the risk response in the RACI chart, as this is a tool that assigns the roles and responsibilities of the stakeholders for each task or activity in a project or process. RACI stands for Responsible, Accountable, Consulted,and Informed, which are the four types of involvement or participation that a stakeholder can have in a task or activity. A RACI chart is a matrix that shows the tasks or activities as rows and the stakeholders as columns, and indicates their roles and responsibilities using the RACI codes. A RACI chart can help clarify and communicate who is doing what, who is making decisions, who is providing input, and who is being updated in a project or process1.
A resource management plan, a risk management plan, and a risk register are also important documents for managing IT risks, but they do not provide the information about who is responsible for the risk response. A resource management plan is a document that defines how the resources, such as human, financial, physical, or technological resources, will be acquired, allocated, managed, and controlled in a project or process. A resource management plan can help ensure that the resources are available and sufficient for the risk response activities. A risk management plan is a document that defines how the risks will be identified, analyzed, evaluated, treated, monitored, and communicated in a project or process. A risk management plan can help ensure that the risks are managed effectively and efficiently according to the enterprise’s objectives and policies. A risk register is a document that records the risks that may affect the achievement of an objective or the performance of an activity, as well as their likelihood, impact, mitigation strategies, and status. A risk register can help identify and prioritize the risks that need to be addressed or monitored.
