A business unit head who owns a customer portal declines to fund remediation of a vulnerability that the risk assessment rated high, above the organization's documented risk appetite. The unit head says the business will simply accept the risk. What should the information security manager do?

Risk owners are entitled to make treatment decisions, but only within the authority delegated to them, and that authority is bounded by the risk appetite senior management has approved. Acceptance must also be informed, so the information security manager first confirms that the owner understands the likelihood, impact and business consequences of the vulnerability. Because the residual risk exceeds the documented appetite, the decision must then be escalated to the level of management that has authority to accept it or to direct treatment. Simply recording the acceptance treats the owner's authority as unlimited and leaves the enterprise operating outside its own appetite without the knowledge of those accountable for it. Funding the fix from the security budget overrides the owner's decision and confuses accountability; security does not own the business risk or its treatment cost. Applying compensating controls without the owner bypasses the risk governance process and may disrupt the portal without business agreement. Exam caveat: the information security manager never accepts the risk on the business's behalf and never forces treatment unilaterally. Operational check: confirm the escalation reached the authorized approver, and that the decision, rationale and review date are recorded in the risk register.