If the business wants to accept a risk I think is unacceptable, then how do I proceed?

Start

The business wants to accept a risk you think it should not

Disagreement is normal and the method expects it. The executive who would feel the harm owns the risk and decides what to do about it. The security team assesses, advises and reports. Your aim is a decision taken on the right facts, at the right level, with the dissent visible to the people who sign.

• Then: Does the risk exist because a policy or standard rule is not met?

Decision

Does the risk exist because a policy or standard rule is not met?

If a required control is missing, late or configured differently from the standard, the acceptance form is the wrong route. The head of information security checks this before the form goes for signature. If you are not sure, treat it as a broken rule until the rule's owner says otherwise.

• Yes, or not known: Send it down the exception route instead
• No: Do you think the risk is rated too low?

Outcome

Send it down the exception route instead

A broken rule needs a time-limited security exception, approved by its band. Where it leaves a risk outside appetite or Critical, the approver for that position signs as well. If the exception is refused, the rule must be met: an acceptance can never be used to get round a refused exception.

Decision

Do you think the risk is rated too low?

Often the real disagreement is about the rating. A rating that is too low sends the decision to someone too junior. Look for controls counted without evidence that they work, and impact judged on a milder consequence than the worst credible one.

• Yes, or not sure: Challenge the rating against the anchors, with reasons
• No: Does the form weigh every option and set checkable conditions?

Step

Challenge the rating against the anchors, with reasons

A manager may disagree with a rating and give a reason; nobody chooses a band. Between two levels, use the higher, and missing information raises the rating. The head of information security settles disputed ratings and checks every High and Critical one. Where one person is both assessor and head of information security, a second person, such as an external adviser, checks the High and Critical ratings.

• Then: Does the form weigh every option and set checkable conditions?

Decision

Does the form weigh every option and set checkable conditions?

The form must show why reducing, avoiding and transferring were each not chosen, what they would cost, and why keeping the risk is worth it. Conditions must be ones someone else can check. 'Not feasible' with no reason, 'business need' and 'staff to be careful' are the pack's common reasons for returning a form.

• No, or not known: Return the form, saying what is missing
• Yes: Where does the risk sit against appetite?

Step

Return the form, saying what is missing

Name each gap: the option not costed, the reason with nothing to weigh, the condition nobody can check. A good reason sets the cost of reducing the risk against the harm, and says when that changes. Returning a form is a quality check. It does not refuse the acceptance.

• Then: Does the form weigh every option and set checkable conditions? (back to an earlier step)

Decision

Where does the risk sit against appetite?

The position, read from the residual band and the category's appetite, decides who else must sign. Nobody works it out afresh: the position table covers every combination. If it is not settled, take the stricter position.

• Within appetite: Is it Medium or High, so your signature is required?
• Outside appetite, within tolerance: Take it to executive management with your view
• Outside tolerance, Critical, or not known: Only the top of the organisation may accept: take it there

Decision

Is it Medium or High, so your signature is required?

In the pack's defaults, the head of information security co-signs Medium and High acceptances. A Low risk is the risk owner's to accept alone. An acceptance is approved only when every signature its band requires is on the form.

• Yes: Sign on conditions you can check, or refuse and ask for treatment
• No, it is Low: Low: the owner may accept; give your advice in writing

Outcome

Sign on conditions you can check, or refuse and ask for treatment

The form's decision field allows accepted, accepted with conditions, or refused: treat instead. A refusal sends the risk to the treatment plan for one of the other options. If you think the appetite itself is set too high, raise it at the appetite statement's review. Changing a level is a board decision, made openly.

• Then: Was the acceptance approved at the level it required?

Outcome

Low: the owner may accept; give your advice in writing

A correctly rated Low risk is within appetite in every category, so the owner may accept it alone. The pack sets no formal step for recording dissent here. Put your advice to the owner in writing, and look at the risk again at its quarterly review. If the facts change, a trigger forces a reassessment.

Outcome

Take it to executive management with your view

Outside appetite, executive management signs as well as the band's approvers, as a recorded decision. Where you are one of the band's approvers, you may still refuse or add conditions. Brief them as the pack asks of any escalation: the risk, its band and position, and the decision needed, with your advice. If the owner makes no treatment decision within the window, 30 days by default, you escalate that too.

• Then: Was the acceptance approved at the level it required?

Outcome

Only the top of the organisation may accept: take it there

Outside tolerance, and for any Critical risk, the band's approvers only recommend. Who decides depends on how you are governed: the board, or a board risk committee it has delegated to; in a two-tier structure, the management board; with no board, executive management. Tell the chair out of cycle. Their options are to fund or order treatment, accept explicitly and record why, or change the appetite.

• Then: Was the acceptance approved at the level it required?

Decision

Was the acceptance approved at the level it required?

Check the form's signatures against the band and position. An acceptance signed below the required level is not approved, whatever the register says. Once it is properly approved, the decision stands, even where you advised against it.

• Yes: Hold it to its conditions and its review date
• No, or refused: Not approved: get the right signatures, or treat instead

Outcome

Hold it to its conditions and its review date

The owner checks the conditions every quarter. Where the form says so, a broken condition or a trigger reopens it. At the review date it is renewed on a fresh score at the band's level, or it ends. An acceptance past its review date is counted and reported to executive management.

Outcome

Not approved: get the right signatures, or treat instead

An acceptance signed below its required level is not yet approved: take it to the right approvers. If it was refused, the risk goes back to the owner for reduce, avoid or transfer, recorded in your treatment plan with owner, date, cost and expected score. Outside appetite, the treatment window keeps running from the first assessment.