Suppose your company has just passed a security risk assessment exercise. The results display that the risk of the breach in the main company application is 50%. Security staff has taken some measures

The risk has been reduced to 10%, which is already below the company's 20% risk threshold. Accepting risk is the appropriate decision when residual risk is within tolerable limits, as spending more resources to reduce it further provides diminishing business value and hinders project profitability.

Introducing more controls to achieve 0% risk is neither practical nor cost-effective, and pursuing zero risk would consume resources far beyond what the business benefit justifies.

Mitigation has already been performed successfully and the risk is now below the acceptable threshold, making further mitigation steps unnecessary and wasteful.

Avoiding the risk would mean discontinuing the application entirely, which eliminates all business value and is not warranted when residual risk is already below the acceptable threshold.