In all but the smallest organizations, decisions of one sort or another are made at various levels and by many people.
Since every decision is partly a decision about risk, organizations delegate the responsibility for risk management and the authority to make risk decisions (for short, “delegate risk”) in the same way they delegate decision-making authority.