Try a CRISC question.

Governance

After an assessment at a manufacturing company, the plant director refuses to fund mitigation of an OT network risk rated above tolerance and says the plant will live with it. Under the company's policy, the director may accept risks up to tolerance but not above it. What should the risk practitioner do NEXT?

• AEscalate through the governance path to management with authority for this risk level
• BReport the director to internal audit for failing to follow the risk policy
• CFund a low-cost network segmentation control from the IT budget to reduce the risk
• DRecord the director's acceptance in the register and close the risk as treated