What is risk acceptance?
Risk acceptance, also called risk retention, is one of the four risk treatments alongside mitigation, transference and avoidance. The organization knowingly takes on a risk, or the residual part of a risk after other treatments, and decides not to spend more reducing it. It is a deliberate business decision, made by someone with the authority to make it, and it is written down.
When acceptance is the right choice
- Treatment costs more than the expected loss. If a control costs $50,000 a year to remove $10,000 of annualized loss expectancy (ALE), accepting the risk is the rational choice on cost alone.
- The risk already sits within the organization's risk appetite.
- No practical control exists, or the risk left after mitigation cannot be reduced further at a reasonable cost.
- The asset is about to be retired, such as a lobby kiosk scheduled for replacement next quarter.
Acceptance is off the table when a law, regulation or contract requires the control. If a regulation mandates encryption at rest, the cost-benefit result does not matter.
Acceptance must be documented and approved
Because acceptance is a decision, it leaves a record in the risk register: the risk, the reason it is being accepted, the residual score, who accepted it, the date, and when it will be reviewed again. The approver needs authority for that level of risk, so higher scores need more senior sign-off. A common pattern lets the risk owner accept medium residual risks, sends high risks to an executive risk committee, and reserves critical risks for the board.
A risk nobody has decided anything about has not been accepted. It is unmanaged, and auditors treat it as a finding. Ignoring a risk is not a treatment, even though from the outside it can look like acceptance.
Exceptions and exemptions
A risk exception is a formal, time-limited approval for a specific system or group to deviate from a security policy or standard. It is a form of acceptance, normally backed by compensating controls. For example, a lab analyzer that cannot take OS patches until its vendor certifies them might be granted a six-month exception from a 14-day patching standard, on condition that it sits on an isolated VLAN with no internet route. At expiry the exception is reviewed: the system is brought into compliance, or the exception is renewed with fresh approval.
Exemption is a closely related term. Some organizations use it for a broader or longer-lasting release from a requirement, such as a policy clause that does not apply to a business unit at all, while others treat exception and exemption as synonyms. Either way, it is recorded, approved and reviewed.
Risk acceptance vs. the other treatments
| Treatment | What happens | Example |
|---|---|---|
| Accept | Carry the risk knowingly, with sign-off | Keep an old kiosk until its replacement date |
| Mitigate | Add controls to lower likelihood or impact | Deploy MFA and EDR |
| Transfer | Shift financial impact to another party | Buy cyber insurance |
| Avoid | Stop the activity that creates the risk | Retire an internet-facing legacy application |
Treatments are often combined: mitigate most of a risk, insure part of what remains, and accept the rest.
Risk acceptance on the CompTIA Security+ exam
Risk acceptance is one of the treatment options in SY0-801 objective 5.2. A scenario in which management decides the cost of a fix exceeds the potential loss and documents that decision points at acceptance. An approved, time-limited deviation from a policy with compensating controls is an exception, which is a form of acceptance. Distractors include avoidance (the activity stops), transference (insurance or a contract shifts the cost) and mitigation (controls are added). When a question asks who may accept a risk, the answer is the risk owner or senior management with authority for that level, not the analyst who found the problem. If a regulation requires the control, acceptance is the wrong answer.