Risk acceptance and exceptions
Which risks have we knowingly accepted, and who signed?
Every organization accepts risk; the question is whether it does so on purpose. Silent exceptions (the control that was waived and never revisited) surface in the post-incident review, attached to no name and no expiry date.
Note
Adopting a page here decides nothing for you. The leadership pages linked here are explanatory and advisory; they establish no requirement and prove nothing about your organization. Every claim in them resolves to the governing reference documents in the corpus, and it is those documents that govern.
Leadership
The leadership pages
Pages from the executive layer mapped to this concern, generated from the narrative registry. They explain and advise; the documents below govern.
Documents
The governing documents
The evidence shelf: the corpus documents the pages above resolve to, joined to the library's registries at build time. These are the documents that govern, and the evidence to ask for starts here.
- Exception and Risk Acceptance Management Policypolicy, Governance
- AI Governance and Risk Frameworkframework, AI
- AI Model Risk Frameworkframework, AI
- Supplier and Cloud Governance Frameworkframework, Supply chain
- AI Security and Risk Standardstandard, AI
- Data Classification and Handling Standardstandard, Security
- Enterprise Risk Management Standardstandard, Risk
- AI System Impact Assessment Procedureprocedure, AI
- Change Management and Configuration Control Procedureprocedure, Operations
- Risk Acceptance Procedureprocedure, Risk
- Risk Register Procedureprocedure, Risk
- AI Board Oversight Guideguide, AI
- AI Incident Response Planplan, AI
- Assurance Map Registerregister, Risk
- Key Risk Indicator Catalogueregister, Risk
- AI System Register Templatetemplate, AI
- Board Risk Report Templatetemplate, Risk
- Risk Appetite Statement Templatetemplate, Risk
- Supplier Offboarding Evidence Templatetemplate, Supply chain
Frameworks
Frameworks touched
The external frameworks the shelf above maps, from the corpus registry. The documents' framework spellings are normalized against the crosswalk's committed alias maps: every spelling that names a crosswalk instrument, whole or by a clause, appears once as the instrument's short label and links its instrument page; a cited text that names no instrument is shown as plain text.
- APEC CBPR
- Basel Committee Corporate Governance Principles
- Basel Committee Operational Risk Principles
- Canada Treasury Board Directive on Automated Decision-Making
- Cloud Security Alliance (CSA)
- COBIT
- COSO ERM 2017
- CSA AI Model Risk Management Framework (2024)
- CSA AICM
- CSA CCM
- DORA
- EBA Guidelines on outsourcing arrangements
- ETSI EN 304 223 V2.1.1
- ETSI TR 104 128 V1.1.1 (2025-05)
- EU AI Act
- FRC UK Corporate Governance Code
- GDPR
- IEEE 2883-2022
- IIA Three Lines Model 2020
- ISO 28000:2022
- ISO 31000
- ISO/IEC 20000-1:2018
- ISO/IEC 23894:2023
- ISO/IEC 27001
- ISO/IEC 27002
- ISO/IEC 27035-3:2020
- ISO/IEC 27036
- ISO/IEC 38507:2022
- ISO/IEC 42001
- ISO/IEC 42005:2025
- ISO/IEC 5338:2023
- ISO/IEC 8183:2023
- ISO/IEC TR 27563:2023
- LGPD
- MITRE ATLAS
- NIST
- NIST AI 100-2e2025
- NIST AI 600-1 (Generative AI Profile)
- NIST AI RMF
- NIST CSF
- NIST IR 8286 (Rev. 1; and 8286A/B/C/D)
- NIST IR 8286C Rev. 1
- NIST SP 800-221 / 800-221A
- NIST SP 800-37 Rev. 2
- NIST SP 800-39
- NIST SP 800-53
- NIST SP 800-88 Rev. 2
- OECD AI Principles
- OECD G20 Principles of Corporate Governance
- OWASP AI Exchange
- OWASP LLM Top 10
- PIPEDA
- PIPL
- SANS CAISG v1.4
Go deeper