Residual risk for a clinic’s EHR downtime remains above tolerance while capital funding for redundant hosting is delayed six months. What should the risk team document now?
Select an answer to reveal the explanation.
Short Explanation
Pending money is not the same as mitigated. Write down the contingency and interim moves, leave the above-tolerance flag honest, and track the funded fix when it comes. Changing the goalposts or pretending it is done fools nobody useful.
Full Explanation
When residual risk for a clinic’s EHR downtime remains above tolerance while capital funding for redundant hosting is delayed six months, the risk team should document contingency and interim actions, keep the above-tolerance status visible, and track the funding-dependent mitigation with honest dates. Transparency protects patient-care continuity decisions. Marking the risk Mitigated because a budget request was submitted fails by concept because a request is not completed mitigation bringing residual within tolerance. Deleting residual scoring until the capital project is approved fails by concept because hiding scores conceals above-tolerance exposure. Lowering tolerance temporarily in the framework so the risk appears acceptable without interim controls fails by concept because moving the goalposts falsifies appetite governance. Exam caveat: CIS-RC keeps above-tolerance visibility with interim contingencies while long-lead mitigations fund. Operational check: record interim contingency actions on the EHR downtime risk, leave residual above tolerance visible, attach the capital mitigation with target date, and report status to the risk committee without changing tolerance definitions. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.