Topics in this domain
- Risk Response Options: Accept, Mitigate, Transfer, Avoid
- Aligning Responses with Appetite and Tolerance
- Cost-Benefit Analysis of Risk Responses
- Bias in Risk Decisions and Reporting
- Risk Owners and Control Owners
- RACI and Escalation
- Third-Party Risk Governance and Due Diligence
- Contracts, SLAs and the Right to Audit
- Monitoring Third Parties and Planning Exit
- Managing Issues, Findings and Control Deviations
- Risk Acceptance, Exceptions and Exemptions
- Control Frameworks and Their Purpose
- Control Types and Functions
- Designing and Selecting Controls
- Implementing Controls and Why Implementations Fail
- Control Design versus Operating Effectiveness
- Control Testing: Objectives, Evidence and Frequency
- Building and Tracking Risk Action Plans
- Collecting and Aggregating Risk Data
- Validating Risk Data Quality
- KRIs, KPIs and KCIs
- Thresholds, Escalation Triggers and Appetite
- Metric Pitfalls and Misuse
- Continuous Monitoring versus Periodic Assessment
- Tailoring Risk Reports to the Audience
- Heat Maps, Dashboards and Scorecards
- Identifying and Assessing Emerging Risks
- Integrating Emerging Risk into Decisions
Risk Acceptance, Exceptions and Exemptions
Who may accept
Risk acceptance is a conscious, documented decision to retain a known risk. Doing nothing isn’t acceptance; it’s an unmanaged risk.
Exceptions, exemptions and acceptances
What every record needs
| Element | Why |
|---|---|
| Description of the risk or gap | Everyone knows what’s accepted |
| Owner and approver | Accountability at the right level |
| Compensating controls | Reduce what’s left |
| Conditions and expiry date | Forces a review |
Example. A legacy plant system can’t be patched until its replacement next year. The plant director accepts the risk for 12 months with network isolation and extra monitoring. At month 12 the replacement is late, and the acceptance goes back to the COO for renewal.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who accepts residual risk | The risk owner with suitable authority |
| Risk beyond appetite | Senior management or board acceptance |
| MOST important element of an acceptance | Owner, authority and review date |
| Accepted risk at expiry | Re-assess; renew, treat or close |
In short
- Risk acceptance is a conscious, documented decision to retain a known risk.
- Acceptance authority scales with the size of the risk; risks beyond appetite need the most senior approval.
- An exception is a temporary, approved departure from a policy; an exemption formally takes something out of a policy's scope.
- Every acceptance, exception and exemption needs an owner, compensating controls where possible and an expiry or review date.
- Unreviewed acceptances quietly become permanent.
Exam traps
- The risk practitioner or IT accepting risk for the business.
- Accepting risk by doing nothing.
- Acceptances with no expiry date.
- Accepting a risk beyond appetite at a low level of authority.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Who may accept
Exceptions, exemptions and acceptances
1 / 7