A county risk owner wants to mark a privacy breach risk Mitigated after drafting three remediation tickets. What must happen first in the risk response lifecycle?
Select an answer to reveal the explanation.
Short Explanation
Mitigated is a finish line, not a sticky note. You still need the response tasks actually done—and residual back inside tolerance—before flipping that status. Drafting tickets without finishing them is just hoping the risk goes away.
Full Explanation
Risk response in IRM separates planning from completion. Response tasks document the work that reduces exposure; marking a risk mitigated before those tasks complete and residual is reassessed against tolerance creates a false closure. Ownership transfer or inherent-score tricks do not substitute for completed treatment and verified residual.