Risk owners

The security team advises on risk and operates controls. The risk itself belongs to whoever owns the thing at stake.

If the finance system is compromised, it is the finance director's problem, not the security manager's. Registers that assign every risk to security have quietly moved accountability to the team with the least authority to change the business decisions that created it.