Risk acceptance

Accepting a risk means somebody with the authority to carry it has said yes, in writing, knowing what they are agreeing to.

Anything else is not acceptance, it is drift. The test is whether the person who would answer for the consequence is the one who signed. Where a security manager accepts a risk that would end up with the board, the acceptance is decorative.