In ISO 27001, the risk owner accepts residual risk, and the decision needs a record. The risk owner is the person with authority over the business impact, such as a department head or executive. An IT manager who lacks that authority should escalate, not mark the risk "accept" because there is no budget.
Where acceptance fits
Clause 6.1.3 covers risk treatment planning. For each risk you pick an option: treat, transfer, avoid or accept. One published guide says the risk owners must formally accept the residual risk, meaning what is left after treatment. Clause 8.3 then requires that the plan is implemented and that records of results are kept.
Why the signer matters
The same guide describes a common finding from audits: a high risk marked as accepted by someone who did not have the authority, often because funding was not available. The point is simple. Business risk belongs to the people who answer for the business. The person who runs the servers may not.
A simple acceptance record
| Field | Example content |
|---|---|
| Risk ID and description | R-42, legacy admin tool without MFA |
| Treatment option | Accept for six months, with compensating monitoring |
| Reason | Replacement scheduled, cost of earlier change judged too high |
| Residual risk rating | Medium |
| Accepted by | Named risk owner with authority |
| Date and review date | Decision date and a firm review date |
Notice the review date. Acceptance is not permanent. Put every accepted risk on the agenda of your management review.
How to get a decision without friction
- State the risk in business terms: what could happen, to whom, and how likely.
- Show the options and what each costs in effort.
- Recommend one, and say what you will monitor if it is acceptance.
- Ask for a yes or no on a date, and record the answer in your risk records.
If the owner declines to decide, that is also information. Record it and escalate through your management structure.
What about transfer?
Insurance or outsourcing can move part of the treatment. One guide notes you cannot transfer accountability for the risk. So the risk owner still signs off on what remains, including how you manage the supplier.
Common mistakes
- Accepting risks in a ticket comment with no named owner.
- Leaving acceptance open ended, with no review date.
- Treating an exception to a policy as acceptance of a risk, with no link between them.
- Letting the security team accept all risks because they raised them.
Quick check
Can the CEO accept every risk?
They can if they are the risk owner, but spreading ownership to people who run each area usually produces better decisions. Define the rule in your risk method.
Do accepted risks need review?
Yes. Set a review date, and revisit them in management review or when circumstances change.
Safeguard's policies and gates can help keep technical exceptions visible. Who may accept a risk is a governance decision for your organization.
Sources
- ISO 27001 clause 6.1.3, risk treatment plan and Statement of Applicability
- ISO 27001 clause 8.3, risk treatment
Last reviewed: 19 October 2026.
