The risk owner should be assigned accountability for monitoring risk levels, as they have the authority and responsibility to manage the risk and its associated controls, and to report on the risk status and performance.
The risk practitioner, the business manager, and the control owner are not the best choices, as they have different roles and responsibilities related to risk identification, assessment, response, and reporting, but they are not accountable for the risk and its monitoring. References = CRISC Review Manual, 7th Edition, page
101.