In a recent LinkedIn post, Francisco Gaffney explores the often-overlooked strategy of risk acceptance, offering practical advice for businesses looking to optimize their approach to potential threats. Gaffney emphasizes that not every identified risk necessitates a solution, advocating instead for a more nuanced and strategic acceptance of certain risks.
Understanding Risk Appetite and Disruption
Gaffney’s core argument centers on the importance of defining a clear risk appetite before making decisions about mitigation. He suggests starting with a risk register and establishing ‘appetite bands’ to categorize potential risks. This foundational step, according to Gaffney, allows businesses to differentiate between risks that warrant immediate action and those that can be strategically accepted.
“Not every risk needs solving. Some can be accepted!”
As Francisco Gaffney notes, the decision to accept or mitigate a risk should be informed by a careful consideration of the potential disruption versus the benefit derived from addressing it. This involves a pragmatic evaluation, moving away from what Gaffney terms as “extreme thinking” that can lead to unnecessary expenditure and resource allocation.
Documenting Decisions and Periodic Review
A key element of Gaffney’s strategy is the documentation of why certain controls are not implemented for accepted risks. This transparency is crucial for ongoing risk management and compliance. He stresses the need for periodic reviews of these decisions to ensure they remain aligned with the business’s evolving risk landscape and objectives.
“Document why controls aren’t added and review everything periodically.”
Gaffney also highlights the benefits of a streamlined, integrated approach to risk management. He points to solutions that offer continuous gap analysis and a clear overview of implemented and outstanding actions, assigning ownership for fixes. This, in his view, leads to a more efficient and effective process.
“All in one place. Continuous gap analysis. Clear view of what’s done, what’s missing, and who owns the fix before assurance or audit.”
The ultimate goal, as Francisco Gaffney advocates, is to implement risk management practices effectively and efficiently, allowing businesses to “do it once, do it properly. Move on.” This approach frees up resources and attention that can be redirected towards core business growth and innovation, rather than getting bogged down in excessive risk mitigation efforts.
📝 About This Content
This article is based on insights shared by Francisco Gaffney on LinkedIn.
📅 Originally posted on December 13, 2025 | View original post on LinkedIn →