Fourteen months ago someone on your team accepted a risk. They had a good reason: a compensating control was in place, the exposure was small, and there were bigger fires. The justification is still sitting in the register, word for word. Is any of it still true?
A review date brings the decision back in front of someone. Here's how to set one, find an acceptance that needs review, and record the next decision.
Record the reason and set a review date
When you accept a risk, write why it is acceptable and choose when to check that decision again: in 3, 6 or 12 months, on a date you pick, or never. The default is 12 months.
Check the justification and review date before you confirm. Both are saved with the acceptance, along with who made the decision and when.
When to choose “never expires”
Use this only when you do not need a scheduled reminder. You can still review the acceptance later if the system, controls or threat changes.
See which acceptances are due
When the review date passes, the observation stays Risk Accepted. It picks up a Review due marker beside the status, shows up under a register filter, and gets counted on the dashboard.
Use the filter or dashboard count to find decisions that need another look. The marker is a reminder to review the acceptance; it does not undo the decision automatically.
Check the risk and record a new reason
Open the finding and check that the original assumptions and compensating controls still hold. Compare today's exposure and threat with the reason for accepting it. If the risk is still acceptable, re-affirm it with a new justification and choose the next review date. You can do this before or after the date is due.
If the old reason no longer holds, do not renew it. Decide how to treat the risk now instead.
Each re-affirmation keeps the previous justification, author and review date in the history. You can see why the decision was made each time without losing the older record.