An employee has worked on the organizational risk assessment. The goal of the assessment is not to bring residual risks to zero, but to bring the residual risks in line with an organization's risk appetite. When has the risk assessment program accomplished its primary goal?

The primary goal of a risk assessment program is to provide decision-makers with the necessary information to make informed choices about managing risk. The process is not complete after analysis or control implementation, but only when a formal decision has been made about the residual risks. When authorized management formally accepts the remaining risks, it signifies that these risks are now aligned with the organization's tolerance and appetite. This act of acceptance is the culmination of the risk management cycle, confirming that the level of risk is acceptable in the context of the organization's strategic goals.

A. Once the controls are implemented: Implementing controls is a risk treatment step; the resulting residual risk may still be unacceptable to the organization.
B. Once the transference of the risk is complete: Risk transference is only one of several risk treatment options and does not represent the goal for all identified risks.
D. When the risk analysis is completed: Risk analysis is an early phase that identifies and evaluates risk; it precedes the crucial decision-making and acceptance stages.

1. NIST Special Publication 800-30, Revision 1, "Guide for Conducting Risk Assessments." Section 2.4, "Risk Response," page 21, states: "Risk acceptance is the appropriate risk response when the identified risk is within the organizational risk tolerance... Risk acceptance is a formal process with a designated official accepting the risk on behalf of the organization." This highlights that the goal is achieved through a formal acceptance decision by a proper authority.

2. ISO/IEC 27005:2018, "Information security risk management." Clause 8.4, "Risk acceptance," specifies that management should make a formal decision to accept residual risks. The standard emphasizes that "The management decision to accept the risk, and the justification for it, should be recorded." This confirms that the process concludes with an authorized, documented decision.

3. Carnegie Mellon University, Software Engineering Institute, "The CERT Risk Analysis Method." The method's final steps involve presenting findings to decision-makers who then choose a course of action, including accepting the risk. The process is designed to "provide a sound basis for management decisions," which is the ultimate goal. (Referenced in courseware like CMU's "Managing Information Security Risks"). The accomplishment is the informed decision, not just the analysis.