Question

A manufacturing company implemented a mitigation control to reduce the risk of unplanned downtime from aging equipment. Post-implementation testing shows the control reduced the likelihood significantly, but the residual risk still sits slightly above the stated risk tolerance. The plant is scheduled for a full equipment replacement in 18 months, which will eliminate the risk source entirely. What is the MOST appropriate next step for the risk practitioner to recommend?

Accepted Answer

Document a formal, time-bound risk acceptance covering the gap until the equipment replacement, with defined monitoring and approval at the appropriate authority level

Answer

Immediately implement additional costly compensating controls to bring residual risk below tolerance regardless of the pending replacement

Answer

Close the risk in the register since a permanent remediation is already scheduled

Answer

Transfer the remaining exposure through an insurance policy before evaluating any other option