A risk practitioner has identified that the agreed recovery time objective (RTO) with a Software as a Service (SaaS) provider is longer than the business expectation. Which of the following is the…

While collaborating with the risk owner is a crucial subsequent step in developing a response plan, the immediate 'best course of action' after identifying such a significant gap is to ensure it is formally documented and escalated to management for awareness and decision authority, before detailed planning begins.

Upon identifying a significant risk such as a mismatch between the agreed RTO and business expectations, the risk practitioner's primary responsibility is to formally record this in the risk register for tracking and to promptly report it to senior management. This ensures proper visibility and governance, enabling high-level decisions on how to proceed, which might include budget allocation for alternatives or strategic acceptance of the risk.

Including a right to audit clause, while good for ongoing oversight, is a contractual measure that does not directly address the already identified RTO gap or mitigate the immediate risk it poses to business continuity.

Advising the risk owner to accept the risk prematurely bypasses a comprehensive assessment and decision-making process; acceptance should be a conscious, informed decision by the risk owner and senior management, not a practitioner's initial recommendation.