The board is ultimately responsible for direction, risk appetite and acceptance of residual risk. Purchasing, legal affairs, information security, architecture, privacy, management and the process owner each provide a necessary part of the picture.
Because choices often have long-lasting consequences, the book calls sovereignty ‘chefsache’. The subject cannot be confined solely to technology or contract management.