Who assigns inherent risk ratings?

Inherent risk ratings are usually assigned through the TPRM process using input from the business owner, procurement, security and the supplier. Ownership varies by organisation, but the score should follow documented rules and be revisited when the relationship changes.