Who should own risk quantification across identity and controls?

Why This Matters for Security Teams

Risk quantification across identity and controls is not a reporting exercise. It determines which identity gaps get funded, which control failures get remediated first, and which business exposures remain acceptable. If ownership sits in only one function, the model skews toward either technical severity or compliance language, and neither is enough to drive prioritisation. NHI Management Group has repeatedly shown how widespread the exposure is in practice, including the Ultimate Guide to NHIs and the Top 10 NHI Issues.

This is especially important because identity risk crosses operational, governance, and financial boundaries. IAM sees where service accounts, secrets, and entitlements are overexposed. GRC maps those exposures to policy, audit, and control obligations. Finance translates that into business value at risk, remediation cost, and timing. The NIST Cybersecurity Framework 2.0 is helpful here because it reinforces that risk management is a cross-functional outcome, not a single-team deliverable. In practice, many security teams discover this only after the model has been built, approved, and then ignored because no one owned the decisions it was meant to support.

How It Works in Practice

Shared ownership works best when each function owns a distinct part of the quantification pipeline. IAM supplies the control inventory and exposure signals: identity counts, privilege levels, secret age, rotation gaps, and authentication paths. GRC defines the control obligations and the evidence standard, so the scoring model remains tied to policy and audit realities. Finance assigns business context, such as service criticality, outage impact, fraud exposure, or cost of delayed remediation.

Current guidance suggests the operating model should be explicit about decision rights. One team can steward the model, but it should not also act as sole validator of the assumptions. A common pattern is:

• IAM maintains the identity and entitlement facts.
• GRC maps those facts to control failure modes and policy exceptions.
• Finance validates impact bands and funding thresholds.
• Risk leadership resolves disagreements and signs off on the final weighting.

For identity-heavy environments, the quantification should also be refreshed against real exposure data, not annual spreadsheet reviews. That is consistent with NHI governance advice in the Ultimate Guide to NHIs and with agentic and machine identity concerns raised in the OWASP NHI Top 10. Best practice is evolving toward evidence-driven models that link entitlements, compensating controls, and business impact at runtime or near real time. These controls tend to break down when the organisation has multiple IAM platforms, inconsistent asset criticality ratings, and no agreed method for converting control failure into financial loss.

Common Variations and Edge Cases

Tighter ownership models often increase coordination overhead, requiring organisations to balance faster decisions against stronger assurance. In mature environments, one central risk function may own the methodology while IAM, GRC, and finance each own a formal input stream. That reduces duplication but still preserves accountability.

There is no universal standard for this yet, so the main tradeoff is between precision and speed. Smaller organisations often collapse the work into one security leader plus finance support because the data set is limited. Larger enterprises usually need a federated model because identity risk differs across cloud, SaaS, CI/CD, and privileged access domains. If the question involves third-party access, privileged automation, or AI agents, the ownership model should expand to include the teams responsible for those workloads, because the exposure is not just human-driven access.

Where this guidance becomes weak is in organisations that cannot produce trustworthy identity data. If service accounts are not inventoried, secrets are stored outside managed systems, or control ownership is unclear, then quantification becomes an estimate rather than a decision tool. In those cases, the first priority is governance of the data sources themselves, not a more complex scoring model.

Related resources from NHI Mgmt Group

• Who should own non-human identity risk in an IAM programme?
• Who is accountable when identity security controls fail across IAM, PAM, and NHI programmes?
• Who should own PKI risk inside an identity programme?
• How do governance teams know whether identity controls are reducing risk?