Accepting a risk is a management decision: the organisation records that it is willing to carry the risk that remains after treatment. Diri keeps every such decision in the risk acceptance register, so you can always see who accepted what, at which risk level, on what grounds, and for how long.
Risks are accepted in three ways:
The acceptance threshold is where your organisation stops accepting risk. A risk scores the mean of its probability and consequence on the same 0–100 scale as the risk matrix. Anything above the threshold counts as unacceptable:
Administrators set the threshold in Settings, under Risk acceptance threshold next to the risk matrix settings:
The threshold is set per organisation, and can be turned off. Without a threshold, risks can still be accepted and escalated, but Diri does not judge them against a line. Sub-organisations that inherit settings from a parent organisation use the parent's threshold. See Settings and What is offered to the organisations below.
Accept a risk when the organisation is willing to carry its residual risk.
The acceptance is recorded in the acceptance register with your name, the date and the score at the time. The risk's owner is recorded as the owner on the acceptance. In the registry, the risk's status becomes Accepted.
Escalate a risk when its residual risk is higher than you are entitled to accept, and it needs an owner who can accept it at that level.
The new owner is notified that they have been assigned as risk owner. In the registry, the risk's status shows Escalated to and the person's name. Use the status filter Escalated to find escalated risks.
The register lists every risk the organisation has accepted, whether by signing an assessment, by accepting it directly, or by approving an assessment. Each record keeps the score and the criteria as they stood at the time.
To open it, click Acceptance register in the risk registry. Click Back to risk registry to return.
| Column | Shows |
|---|---|
| Risk and Assessment | What was accepted, and where it comes from. |
| Accepted by | Who made the decision. |
| Risk owner | Who owns the risk. Acceptances without an owner are flagged with No owner recorded. |
| Accepted and Valid until | When the risk was accepted and when the acceptance expires. Expiring soon is shown as the number of days left; expired as Lapsed. |
| Score / threshold | The risk level and the acceptance criteria at the time of acceptance. If the risk's score has changed since, the register says whether it is now higher or lower. |
| Source | Assessment signature, Accepted directly or Assessment approval. |
| Justification | Why the risk was accepted. |
Withdrawn and superseded decisions are kept. A withdrawn record shows who withdrew it and why.
The summary at the top shows how many acceptances there are, how many come from signing an assessment, and how many have lapsed and need re-signing.
Acceptances are snapshots and are never changed afterwards. If risk figures change later, the register shows the score now beside the score at acceptance, so you can decide whether the decision needs to be revisited.