Comprehensive and Detailed Explanation From Exact Extract:
When a risk treatment plan does not reduce residual risk as expected, the immediate next step is to evaluate whether the current level of residual risk remains within the organization's defined risk appetite. If the residual risk is acceptable per the risk appetite, it may be tolerable without further mitigation. If it exceeds risk appetite, additional measures should be considered. Changing the risk assessment method is not a direct response to residual risk management. Acceptance should only occur if the risk is within tolerance levels【5:230, 5:231†CRISC_SentenceinNOTE30.pptx】.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit