Lesson 5 of 7
Risk acceptance and escalation
10 min
Listen to this lesson
Every go-live carries open issues. The framework's job is not to pretend otherwise but to make sure each open issue is either fixed, consciously accepted by someone with the right authority, or allowed to block. Risk acceptance is the formal record of that conscious decision. Escalation is the path a decision takes when the person at one level cannot or will not make it in time.
What a risk acceptance contains
- The issue: defect or gap, with its identifier, severity and affected process.
- Business impact: what happens if it occurs, in business terms, with an estimate where possible.
- Workaround: what users do instead, and evidence that the workaround was tested.
- Conditions: monitoring, extra controls, training or communications required.
- Owner and fix date: who fixes it and by when.
- Expiry: the date the acceptance lapses; after that, it must be renewed or the issue fixed.
- Approver: the person with decision rights for this severity, with date and signature.
- Issue foundDefect logged with severity and process
- Fix or accept?Owner estimates fix; if not fixable before the gate, a risk acceptance is drafted
- Workaround testedKey user proves the workaround and records evidence
- Approver decidesApprover with the right authority accepts with conditions, or refuses
- MonitoredConditions tracked; register reviewed at each gate and weekly in hypercare
- Closed or renewedFixed and retested, or renewed by the approver before expiry
Risk acceptance is also an internal control. Finance teams in many companies frame their controls with the COSO Internal Control - Integrated Framework, refreshed in 2013. Ask your controller which controls a go-live risk acceptance touches, so that accepted issues in financial processes are visible to the people who assess controls.
Rules that keep it honest
| Rule | Why |
|---|---|
| Critical issues cannot be risk-accepted for go-live | A process that stops or misstates finances is not a risk to accept; it is a reason not to go |
| The workaround must be tested, not described | Untested workarounds fail on the first busy day |
| Every acceptance expires | Without an expiry, accepted issues become permanent features |
| No self-acceptance | The person who owns the fix cannot approve living with the issue |
| Aggregate view at go/no-go | Ten medium acceptances in one process can add up to a high risk; steering reviews them together |
| Financial and control issues involve finance | Anything affecting postings or controls needs Dan or the controller's agreement |
Rules for risk acceptance in Contoso's framework.
Escalation paths and time limits
Escalation should be predictable and fast. Write down who escalates to whom, and the maximum time a decision may wait at each level. During cutover the limits are hours, not days.
- Within 1 working dayKey user and test leadAgree severity and whether a workaround exists
- Within 2 working daysProcess ownerAccepts within rights, or escalates with a recommendation
- Next steering meeting or within 5 daysSteering committeeDecides high-severity acceptances and disputes
- Cutover windowCutover command centerDecisions within 2 hours; Grace convenes the accountable owners by phone
What would you do?
Two days before go/no-go, Dan learns that an accepted medium defect in procure to pay (duplicate invoice check not triggering for one invoice type) also affects the AP balance at month-end if it occurs. The process owner accepted it alone. What should happen?
- Every open issue is fixed, consciously accepted by the right approver, or blocks.
- A risk acceptance states impact, tested workaround, conditions, owner, fix date, expiry and approver.
- Critical issues cannot be accepted; nobody accepts their own issue; finance joins anything financial.
- Escalation paths have time limits, shorter during cutover.
Check your understanding · not graded
Lesson check
1. Why must every risk acceptance have an expiry date?
2. What must be true of the workaround in a risk acceptance?
3. During the cutover window, what changes about escalation at Contoso?
4. A risk acceptance reaches its expiry date with the fix not delivered. What happens?