After treatment, a residual risk on a customer billing system still sits slightly above the documented tolerance threshold. The control owner proposes to formally accept the remaining exposure. How should the risk practitioner respond to this proposal?
- AAllow the control owner to accept the exposure, because the control owner understands the control best and can judge whether it is sufficient
- BRecord the control owner acceptance and close the item, because the residual figure exceeds tolerance only by a slim and immaterial margin
- CAccept the residual risk personally on behalf of the organisation, because the practitioner has the clearest independent view of the exposure
- DEscalate the decision to the risk owner, because accepting residual risk above tolerance rests with the accountable owner, not the control owner Correct
Why A is wrong: Knowing the control well is useful, but operating a control does not grant authority to accept residual exposure that exceeds the agreed tolerance.
Why B is wrong: A small breach still breaches tolerance, and closing on a margin judgement bypasses the proper acceptance authority and leaves the decision undocumented by the owner.
Why C is wrong: Independence is the practitioner role, so accepting risk personally would breach that independence and assume an accountability the practitioner does not hold.
Why D is correct: Residual risk acceptance is a risk ownership decision, so a control owner cannot formally accept it, and the practitioner routes the choice to the accountable risk owner.