Understanding Risk Status

Open

This status is used when a risk has been identified but your organization has not yet determined how to address it. An open risk may require further analysis, consultation with stakeholders, or prioritization before a decision is made. Keeping a risk open signals that it is being actively reviewed and has not been ignored.

Accepted

A risk is marked as accepted when the organization has decided to acknowledge it without taking further action. This usually occurs when the risk is within the organization’s tolerance levels, the potential impact is deemed low, or mitigation would be too costly or disruptive. Accepting a risk still requires monitoring to ensure it does not escalate unexpectedly.

Mitigated

This status applies when your organization has implemented controls, safeguards, or a treatment plan to reduce the risk’s likelihood or impact. A mitigated risk indicates proactive management, and ongoing monitoring is important to confirm that the mitigation measures remain effective over time.