Question

A business unit manager wants to accept a newly identified risk whose estimated exposure exceeds the organization's defined risk appetite. The manager argues that mitigating controls would delay a critical product launch and that the risk is temporary. What is the risk practitioner's BEST course of action?

Accepted Answer

Escalate the risk acceptance decision to the appropriate governance authority for approval before it can be accepted

Answer

Allow the business unit manager to formally document the acceptance since they own the risk and the business process

Answer

Require the manager to implement compensating controls immediately regardless of the launch timeline

Answer

Reject the acceptance and record the risk as avoided in the risk register