The person who runs the day-to-day is the person best placed to see where it breaks. That is why risk lands on the Chief Operating Officer. Not because the COO is the company's insurance policy, but because the COO owns the machine that risk actually threatens: the plants, the vendors, the systems, the people, the cash cycle. When a single supplier fails or a payment system goes down, it is the COO's operation that stops.

This article is about ownership, not method. If you want the step-by-step mechanics of scoring and ranking threats, that lives in the risk assessment framework. Here the question is different: what does it mean for a COO to own risk, where does that ownership start and stop, and how do you run it so it protects the company without smothering it?

The short version: a strong COO treats risk as a standing part of how the business is run, wired into weekly operating reviews, budgets, and vendor decisions. A weak one treats it as an annual binder that gets dusted off for the audit committee and ignored the other fifty weeks of the year.

Why risk belongs to the COO, not just a committee

Most large organizations have a risk committee, and some have a Chief Risk Officer. That does not move accountability off the COO's desk. A committee sets appetite and reviews the register; a CRO in financial services owns models and regulatory capital. But the COO owns execution — the actual controls, the actual redundancy, the actual response when something fails at 2am. Risk that is not owned by whoever runs the operation tends to be documented, not managed.

The distinction between the roles matters, and confusing them is a common failure:

Strong looks like: the COO can name, without notes, the three failures that would most hurt the business in the next twelve months and describe the specific control or backup for each. Weak looks like: "risk is handled by the risk team" — a sentence that means no operating leader personally owns any of it.

How to do it: put risk on the agenda of your regular operating review, not a separate quarterly ceremony. When you review a plant's output or a region's numbers, review its top exposure in the same conversation. Risk that shares a meeting with performance gets managed; risk that has its own rarely-attended meeting gets filed.

The operating model: three lines and a single owner

The cleanest way to structure who-does-what is the three-lines model, and the COO's job is to keep all three honest.

• First line — the people who run the process own the day-to-day controls. A warehouse manager owns stock accuracy; an IT lead owns access controls. They live closest to the risk and catch it first.
• Second line — risk and compliance functions set standards, monitor, and challenge the first line. They do not run the operation; they check that it is being run safely.
• Third line — internal audit independently tests whether the first two lines actually work, and reports to the board, not to management.

A strong COO makes sure the first line genuinely owns its controls rather than assuming "compliance has it covered," and protects the independence of the third line even when its findings are uncomfortable. A weak setup collapses the lines together — the same team that runs the process also signs off that it is safe — which is how quiet failures survive for years.

Alongside this sits risk appetite: an explicit statement of how much of each risk the company is willing to carry. A concrete example: a mid-sized manufacturer might decide it will tolerate a single-source supplier only where switching is possible within four weeks, and will hold dual sources everywhere else. That is an appetite the COO can actually operate against when a procurement lead proposes a cheaper sole-source deal. Without a written appetite, every risk decision becomes an argument from scratch.

Wiring risk into how the business already runs

The mark of mature risk ownership is that it disappears into normal operations. Established operating disciplines already carry risk controls — the COO's job is to use them rather than bolt a parallel process on top.

• Process work (lean, Six Sigma DMAIC, or a simple PDCA loop) surfaces the failure modes and variation that create operational risk in the first place. Reliable processes are the cheapest risk control you own.
• Business continuity and disaster recovery plans turn "what if it goes down" from a fear into a tested runbook. The key word is tested — a continuity plan that has never been rehearsed is a document, not a capability.
• Supplier redundancy is the practical answer to concentration risk; the mechanics of building it out are covered in supply chain resilience.
• Change management (a Kotter-style approach, for instance) reduces the risk that a transformation quietly breaks the operation it was meant to improve.

The concrete test of whether risk is truly embedded: could you point to a real operating decision in the last quarter that changed because of a risk consideration? A supplier you added, a launch you sequenced differently, a control you tightened after a near-miss. If every risk decision is theoretical, risk is not yet in the operating model — it is in a spreadsheet.

Cyber, supply chain, and people: where COOs get tested most

Three exposures dominate most COOs' real risk load, and each has a matching operating response rather than a slogan.

Technology and cyber. The exposure is not only a breach; it is downtime, a ransomware lockout, or a vendor system failure that stops your operation. Ownership here means the COO knows which systems the business cannot run without, what the recovery time actually is when one fails, and whether staff can spot the phishing email that starts most incidents. The deeper playbook sits in the cybersecurity handbook; the COO's part is making sure recovery is tested, not assumed. Supply chain and operations. Concentration is the silent risk — one supplier, one port, one component. A strong COO maps the single points of failure and holds either a backup source or a deliberate, documented decision to accept the concentration. Building the broader capacity to absorb shocks is the subject of operational resilience. People and culture. Key-person risk, retention of critical skills, and a workforce that either flags problems early or hides them are all operating risks. The controls are unglamorous: succession plans for roles that would hurt if they emptied, and a culture where raising a near-miss is rewarded rather than punished. A team that hides small failures guarantees large ones.

Reporting risk up: the board conversation

Owning risk includes owning the story the board hears about it. This is where many capable operators stumble — they either drown the board in a hundred-row register or reassure them with a green dashboard that hides the two things that actually matter.

Strong board reporting is short and honest: the handful of exposures that could genuinely threaten the plan, what is being done about each, what has changed since last time, and what decision (if any) the board needs to make. Weak reporting is a color-coded grid with no narrative, where everything is amber and nothing demands attention. The skills that make this land are the same ones covered in board communication, and the CEO should never be surprised by a risk in front of the board — align the message before the meeting, never during it.

A simple structure that works: lead with the two or three risks that moved, state whether each is inside or outside appetite, and end with any decision you need. Reserve the full register for an appendix. Boards remember what you highlight, not what you attach.

Key takeaways

• Risk ownership follows operational ownership. The COO runs the machine risk threatens, so the COO owns operational and execution risk — a committee or CRO sets appetite and oversight, but does not run the controls.
• Embed, do not bolt on. Risk that shares a meeting with performance gets managed. Use existing disciplines — lean, continuity plans, change management — as your controls rather than building a parallel process.
• Write down the appetite. An explicit tolerance ("dual-source unless switching takes under four weeks") turns every future risk decision from an argument into a check.
• Test, don't document. A continuity or recovery plan that has never been rehearsed is not a capability. The proof of real risk management is a rehearsed response and an operating decision that actually changed because of a risk.
• Report the two that matter. Boards act on the handful of exposures you highlight, framed against appetite — not on a hundred-row amber grid.

Frequently asked questions

What is the difference between the COO's risk role and a Chief Risk Officer's? The CRO (where one exists, most often in banking and insurance) owns risk appetite, aggregate exposure, and regulatory and financial risk models — an oversight and framework role. The COO owns the working controls, redundancy, and response inside the running operation. In companies without a CRO, the COO effectively carries both, which makes writing down risk appetite explicitly even more important. How is COO risk management different from a risk assessment framework? A framework is the method for identifying, scoring, and prioritizing threats — the analytical engine, covered in the risk assessment framework. This article is about the COO's ownership: turning that analysis into real controls, embedding it in operating reviews, and being personally accountable when something fails. The framework tells you what to worry about; ownership is what you do about it every week. Should the COO or a risk committee set the company's risk appetite? The board and risk committee set the appetite, because it is a strategic choice about how much risk the company is willing to accept. The COO's job is to translate that appetite into operating rules the business can actually run against, and to flag when a good operational decision would breach it. Appetite that lives only in a board minute and never reaches procurement or IT is not operational. How does a COO stop risk management from slowing the business down? By managing to appetite rather than to zero. The point is not to eliminate every risk — that stalls growth — but to accept known risks deliberately and control the ones that could be fatal. A written appetite lets teams move fast inside the lines without escalating every routine decision, which is faster than a culture where everyone is afraid to act. What are the most common risk management mistakes COOs make? Three recur: treating risk as an annual binder instead of a standing part of operating reviews; letting the people who run a process also sign off that it is safe (collapsing the three lines of defense); and reporting a green dashboard to the board that hides the exposures that actually matter. Each replaces real management with the appearance of it. How does the COO connect risk management to crisis response? Risk management is the work you do before a crisis; crisis management is what happens when a risk lands anyway. The two share the same plans — a tested continuity runbook is both a risk control and the opening move of a crisis response. The tactics for the response itself are covered in crisis management for COOs, but the quality of that response is set months earlier by whether the COO rehearsed it.