Planned controls for a new trading platform have been implemented, but the residual risk is still above the organization's risk appetite. The business wants to launch next week. What should the information security manager do?
Select an answer to reveal the explanation.
Short Explanation
Finishing the to-do list doesn't mean the job's done if the risk is still over the line. You either treat it further or put it in front of the people with authority to accept it. The trap is the security manager deciding alone, whether that's waving it through or slamming the gate.
Full Explanation
Residual risk above appetite cannot simply be ignored because the planned controls are in place. The security manager's role is to make the gap visible and recommend options: additional treatment to bring the risk within appetite, or escalation to senior management, who alone can decide to accept a risk that exceeds the stated appetite, possibly with conditions such as a limited launch or added monitoring. That keeps the decision with those who are accountable. Approving the launch because the plan was completed confuses project delivery with risk outcomes; implementing agreed controls is not evidence that the risk is acceptable. Blocking the launch indefinitely is a business decision outside the security manager's authority, and seeking the lowest possible risk contradicts the principle that risk is managed to an acceptable level, not to zero. Lowering the register rating to reward effort falsifies the record and misleads decision makers about the actual exposure. Exam caveat: acceptance above appetite usually requires a higher level of authority than routine acceptance, as defined in the risk governance framework. Operational check: confirm the decision is recorded with the approving executive's name, the rationale, any conditions and a date for reassessment.