The department head of application development has decided to accept the risks identified in a...

Since the identified risks are subject to regulatory requirements, and cannot simply be accepted without oversight, the information security manager should escalate the issue to the risk management team or higher authority to ensure proper governance.

“When risk acceptance contradicts regulatory requirements, it must be escalated to senior management or the risk function for resolution.”

— CISM Review Manual 15th Edition, Chapter 1: Governance Responsibilities, Section: Risk Governance and Oversight*