Residual risk for a clinic’s EHR downtime remains above tolerance while capital funding for redundant hosting is delayed six months. What should the risk team document now?
Select an answer to reveal the explanation.
Short Explanation
Pending money is not the same as mitigated. Write down the contingency and interim moves, leave the above-tolerance flag honest, and track the funded fix when it comes. Changing the goalposts or pretending it is done fools nobody useful.
Full Explanation
When residual remains above tolerance pending investment, IRM practice documents interim or contingency actions while preserving accurate residual status. Marking mitigated on a budget request alone, hiding residual scores, or lowering tolerance without governance approval misrepresents exposure and weakens decision records.