Risk Acceptance

As Low As Reasonably Practicable — a principle requiring that residual risk be reduced to the lowest level that is reasonably achievable, balancing the cost and effort of further reduction against the benefit gained. The burden of proof lies on the duty holder to demonstrate that further risk reduction is grossly disproportionate to the benefit.

The degree of risk that an organization is willing to withstand in pursuit of its objectives, expressed as specific thresholds or boundaries for different risk categories. Risk tolerance defines the upper boundary of acceptable risk — risks exceeding tolerance levels must be treated, transferred, or avoided. Risk tolerance is more specific than risk appetite and is typically expressed as quantitative criteria.

The amount and type of risk that an organization is prepared to seek, accept, or tolerate in pursuit of its long-term objectives. Risk appetite is a strategic, board-level statement that sets the overall tone for risk-taking across the organization. It is broader and more directional than risk tolerance, which provides specific measurable thresholds.

A discrete, auditable event in the lifecycle of a governed artifact (asset, risk, MOC, inspection) that records a decision, approval, status change, or significant action. Governance events capture who did what, when, why, and with what authorization. They form the backbone of the audit trail and provide the evidence chain for regulatory compliance.

A structured repository that records all identified risks, their assessments (probability, consequence, risk level), treatment plans, residual risk after treatment, risk owners, review dates, and current status. The risk register provides a single authoritative view of an organization's risk landscape and serves as the primary governance tool for tracking risk management activities.