Topics in this domain
- Risk Management Concepts and Frameworks
- Inherent Risk, Residual Risk, Appetite and Tolerance
- Threat Actors, Motivations and Attack Vectors
- The Evolving Threat Landscape: AI, Cloud and Supply Chain
- Threat Modelling and Cyber Threat Intelligence
- Vulnerability Assessment and Scanning
- Control Deficiencies and Security Gap Analysis
- The Risk Assessment Process
- Qualitative Risk Analysis: Likelihood and Impact
- Quantitative Risk Analysis: SLE, ALE and Loss Estimation
- Risk Scenarios and Prioritisation
- Risk Treatment Options: Mitigate, Transfer, Avoid, Accept
- Risk Acceptance: Approval, Expiry and Review
- Cost-Benefit Analysis for Risk Treatment
- Risk Ownership vs Control Ownership
- RACI and Risk Escalation Paths
- The Risk Register
- Continuous Risk Monitoring and Key Risk Indicators
- Risk Reporting to Executives and the Board
- Integrating Risk Management into Business and IT Processes
Risk Acceptance: Approval, Expiry and Review
Acceptance is a decision
Sometimes the best answer is to live with a risk: treatment costs more than the risk, a fix is coming later, or the risk is simply small. That’s legitimate, as long as someone with the authority decides knowingly, writes it down and looks at it again. Ignoring a risk, or not knowing about it, isn’t acceptance.
Who may accept
The bigger the risk, the more senior the approver and the shorter the period before review. A typical scheme:
| Residual risk | Who may accept | Maximum period |
|---|---|---|
| Low | Asset or process owner | 12 months |
| Medium | Business unit head | 6 months |
| High | An executive, after steering committee review | 3 months |
| Beyond appetite | The board or its risk committee only | Until treated; reviewed at every meeting |
The security manager advises and records, but doesn’t accept business risk on the owner’s behalf.
The acceptance process
- Request: the owner explains the risk and why it can’t be treated now.
- Assess: security confirms the rating, the options and any compensating controls.
- Approve at the right level of authority.
- Record in the risk register: owner, reason, conditions, compensating controls and expiry date.
- Review at expiry, or sooner if things change: renew, treat or close.
Policy exceptions are acceptances too
When someone can’t comply with a policy or standard, the exception is a risk acceptance and follows the same process.
Example. A laboratory instrument runs an old operating system that can’t take the standard endpoint agent. The lab head requests an exception. Security adds network isolation as a compensating control, and the business unit head approves it for six months while the vendor certifies a newer version.
Keeping acceptances honest
- Keep one register of all accepted risks and exceptions.
- Send reminders before expiry.
- Report accepted risks to the steering committee regularly, so management sees the total.
- Reassess immediately if threats or the system change.
- Close the acceptance when the risk is treated.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Requirement for valid risk acceptance | Informed, documented approval at the right level |
| Who accepts a risk beyond appetite? | The board / senior management |
| What every acceptance should include | Owner, reason, conditions and an expiry or review date |
| A request for a policy exception | Assess the risk, approve at the right level, time-limit it |
| An accepted risk changes | Reassess the acceptance |
In short
- Risk acceptance is a legitimate, deliberate decision to retain a risk; it must be informed, documented and approved.
- The approver's seniority depends on the size of the risk; risks beyond appetite need the board or its committee.
- Each acceptance records the owner, the reason, any compensating controls and conditions, and an expiry date.
- Policy exceptions are a form of risk acceptance and follow the same process.
- Acceptances are reviewed at expiry and whenever the risk changes, and are then renewed, treated or closed.
- The security manager tracks and reports accepted risks so they don't become forgotten permanent gaps.
Exam traps
- The CISO doesn't accept risks for the business; the owner or management does.
- Acceptance without an expiry or review date tends to become permanent.
- An exception approved by someone without enough authority isn't valid acceptance.
- Accepting a risk doesn't mean forgetting it; it stays in the register and is monitored.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Who may accept
The acceptance process