Risk acceptance

ISO 31000:2018 calls this option retaining the risk by informed decision, and the word "informed" is the whole point. ISO/IEC 27001:2022 builds acceptance into two places: clause 6.1.2 a) 1) requires risk acceptance criteria to be established before assessment, and clause 6.1.3 f) requires risk owners to approve the treatment plan and accept the residual risks. An acceptance that cannot be traced to those criteria, or that was signed by someone without authority over the affected business activity, is a common audit nonconformity. In the NIST Risk Management Framework (SP 800-37 Rev. 2) the equivalent is the Authorize step, in which a senior authorizing official explicitly accepts the residual risk of operating a system.

A defensible acceptance record contains the risk statement, the current residual rating, the reason treatment is not pursued (cost, technical impossibility, planned decommissioning), any compensating controls, the named owner, the approver's level, and an expiry or review date. Mature organisations tie approval authority to rating: a team lead may accept low risks, a director medium, and only the executive board or management body anything outside the documented appetite. Time-boxing matters because the conditions behind the decision change; an unsupported operating system accepted in one year can become the entry point of a widely exploited vulnerability the next.

Acceptance has hard limits. It cannot waive legal obligations: a GDPR controller cannot accept away its duty to notify a personal data breach under Art. 33, and where a data protection impact assessment shows a high residual risk to data subjects, Art. 36(1) requires prior consultation of the supervisory authority, in Denmark Datatilsynet, rather than internal acceptance. Contractual standards behave similarly; in PCI DSS a requirement that cannot be met is handled with documented compensating controls, not by accepting the gap. And risks borne mainly by others, such as customers or data subjects, should not be accepted purely on the organisation's own cost-benefit reasoning.

The anti-pattern is silent acceptance: risks that are known, never treated and never decided on, often visible as ageing findings in vulnerability scans or audit reports. Functionally they are accepted, but without an owner, rationale or review date. The distinction from avoidance is that acceptance keeps both the activity and its risk; the distinction from mitigation is that no further controls are added.