A risk practitioner has identified that the agreed recovery time objective (RTO) with a Software as a Service (SaaS) provider is longer than the business expectation. Which ot the following is the…

The risk practitioner's role is to facilitate the risk management process; therefore, collaborating with the risk owner is crucial to ensure that business needs are met. Together, they can explore options like negotiating with the SaaS provider, implementing compensating controls, or formally accepting the residual risk through a well-defined response plan that aligns with organizational goals and risk appetite.

While documenting the gap in the risk register and reporting to senior management are necessary steps, they are part of the process, not the best course of action for resolving or addressing the identified gap, as the response plan is the active solution.

Including a right to audit clause is important for assurance and oversight of the provider, but it does not directly address or change the agreed RTO or the existing gap with business expectations.

Advising the risk owner to simply accept the risk without prior collaboration or exploring other options is premature and undermines the comprehensive risk management process, potentially leading to unmet business recovery needs.