Who should accept the risk for an unsupported critical application?

Risk acceptance should be made by the appropriate management level, not by internal audit and usually not by the lowest-level technical owner alone. The right approver depends on business criticality, risk appetite, policy, regulatory exposure, and potential impact.

For a critical production application, a sound acceptance record usually identifies:

• business owner,
• IT or security owner,
• risk description,
• affected asset and process,
• compensating controls,
• residual risk rating,
• exception expiry date,
• monitoring requirements,
• remediation owner, and
• escalation path to senior management or the board when material.

Internal audit's role is to evaluate whether that process exists and whether the acceptance is supported by evidence. The auditor should not approve the risk on management's behalf.

If the system is critical and unsupported, and no formal owner accepts residual risk, the finding can be framed as a governance gap: management has not made an explicit, authorized decision about a known cybersecurity and operational exposure.