A process owner claims a security risk belongs only to IT because it involves software. What should the practitioner explain?

1. IT must accept every financial consequence without business participation
2. The risk can be ignored until ownership is agreed
3. The risk should be owned in relation to the affected business outcome, with IT supporting technical treatment
4. Every software risk must be owned by the external auditor