When you decide to tolerate a risk at its current residual exposure, record a formal acceptance from the risk detail page. An acceptance captures who signed off, when, and why, with an optional expiry, and the full history is retained for the audit trail. This is exactly what auditors look for on any risk sitting above your appetite.
Why record an acceptance
Sometimes treating a risk further is not worthwhile, and the organization chooses to live with it. A formal acceptance turns that decision into a documented, dated record rather than an informal understanding, which keeps your risk register defensible.
Record an acceptance
- Open the risk and find the Acceptance section.
- Click Record acceptance.
- Enter a rationale explaining why the risk is accepted.
- Optionally set an expiry, the date by which the acceptance should be reviewed again.
- Click Record acceptance to save. The risk then shows an active acceptance with the accepting user and the date.
Acceptance required
A risk that is over appetite and has no active acceptance is flagged as acceptance required, so gaps in sign off are easy to find using the acceptance filter in the register and on the dashboard. For how a risk becomes over appetite, see Setting Your Risk Appetite.
Expiry and reminders
When an acceptance has an expiry, ISO Mate reminds the owner before it lapses and again once it has expired. An expired acceptance returns the risk to needing attention, and you can filter the register for acceptances that are expiring or expired.
Revoking an acceptance
If circumstances change, you can revoke the active acceptance at any time, which returns the risk to needing a fresh sign off. The full history of acceptances and revocations, including who acted and when, is retained for the audit trail.
Related articles
Keep every risk decision on record. Start your free 14-day trial.