3.2. Risk Response

💡 First Principle: Identifying a risk changes nothing by itself — the organization stays exposed until someone with the authority to act formally decides what to do about it, and that decision gets documented.

⚠️ Common Misconception: Risk acceptance is often assumed to mean doing nothing. Formal risk acceptance actually requires an authorized owner explicitly signing off with documented rationale and ongoing monitoring — it is an active governance decision, not neglect.