Accountability is the principle that a specific, named individual is answerable for an activity or outcome. When information risk is assigned to a collective entity, such as a department, without designating a single individual as the owner, responsibility becomes diffused. This ambiguity makes it unclear who is ultimately answerable for making decisions, allocating resources, and accepting the risk. This lack of a single point of accountability is a significant governance weakness and is the most likely scenario to result in the risk being poorly managed or ignored, as "everybody's responsibility" often becomes "nobody's responsibility."

A. This represents a standard and effective delegation model. The manager remains accountable for the risk, while operational control tasks are delegated to staff, maintaining a clear line of authority.
C. This cross-functional assignment is common in large organizations. As long as roles are clearly defined, it does not inherently weaken accountability; it simply requires effective communication between departments.
D. Assigning both roles to one person concentrates, rather than weakens, accountability. While it may raise segregation of duties concerns in some contexts, it makes it unequivocally clear who is responsible.

1. ISACA, CGEIT Review Manual, 8th Edition. Domain 2: IT Resources, Section 2.4, IT-Related Business Risk. The manual emphasizes that for effective risk management, "risk owners must be identified" and that these owners are "accountable for the management of the risk." Assigning risk to a department without an individual owner violates this core principle of identifiable accountability.

2. ISACA, COBIT 2019 Framework: Governance and Management Objectives. APO12 Manage Risk, Practice APO12.02 Analyze risk. The associated RACI (Responsible, Accountable, Consulted, Informed) charts consistently illustrate that the "Accountable" role is assigned to a specific, singular position (e.g., Chief Risk Officer), not a group. The underlying governance principle is that accountability cannot be shared.

3. Carnegie Mellon University, Software Engineering Institute. "Governing for Enterprise Security (GES) Implementation Guide," CMU/SEI-2008-TN-031, p. 15. The guide states, "Accountability for security cannot be delegated... A specific individual must be designated as accountable for each security role and responsibility." This reinforces the concept that accountability must be tied to an individual, not a collective.