CRISC · Question #511
A risk practitioner has been asked to propose a risk acceptance framework for an organization. Which of the following is the MOST important consideration for the risk practitioner to address in the…
The correct answer is C. Individuals or roles authorized to approve risk acceptance. When establishing a risk acceptance framework, the most critical element is clearly defining who has the authority to approve the acceptance of risk. Without clear accountability, the framework lacks enforceability and proper governance.
Question
A risk practitioner has been asked to propose a risk acceptance framework for an organization. Which of the following is the MOST important consideration for the risk practitioner to address in the framework?
Options
- AConsistent forms to document risk acceptance rationales
- BAcceptable scenarios to override risk appetite or tolerance thresholds
- CIndividuals or roles authorized to approve risk acceptance
- DCommunication protocols when a risk is accepted
How the community answered
(44 responses)- A9% (4)
- B5% (2)
- C84% (37)
- D2% (1)
Why each option
When establishing a risk acceptance framework, the most critical element is clearly defining who has the authority to approve the acceptance of risk. Without clear accountability, the framework lacks enforceability and proper governance.
Consistent forms are important for documentation, but secondary to the authority to make the decision itself.
Scenarios for overriding thresholds are specific conditions, but defining who can approve the override is more fundamental.
Establishing clear authorization levels ensures that risk acceptance decisions are made by individuals with appropriate authority, understanding of the implications, and accountability. This prevents unauthorized personnel from accepting risks that could significantly impact the organization and ensures proper governance over risk management.
Communication protocols are important after a risk is accepted, but do not address the core decision-making authority.
Concept tested: Risk acceptance framework governance
Topics
Community Discussion
No community discussion yet for this question.