##  Establish Risk Dispensation Program
Establish a risk dispensation program to manage risks that cannot be promptly resolved. A risk dispensation formally documents the acceptance of a risk and sets a time for revisiting the risk for remediation or further acceptance. Key elements to be included in a risk dispensation document are:
  * CIO/CTO signature accepting the risk: this includes standard language identifying the risk and acknowledging C-Suite acceptance
  * Time and date of dispensation: documents when the risk acceptance decision was made
  * Time and date to be revisited: specifies when to review the risk again, such as in 1 quarter or 6 months.
  * Detailed description of the risk: provides a comprehensive explanation of the risk and why it cannot be immediately remediated


During this period, risks are continuously monitored, and the decision to accept them is revisited at the end of the specified timeframe. Regular risk review meetings involving IT, business, and Global Risk and Compliance leadership are held to discuss the overall risk landscape. Changes in business or market dynamics typically influence the reclassification of accepted risks.
Alignment across teams is essential for smooth execution and fostering a shared understanding. Include reports and KPIs that offer insights into how risks are evolving over time and how they are being managed. Learn more about monitoring and reporting in [Step 5: Monitor, Measure, and Report Risk Mitigation Efforts](https://help.sap.com/docs/leanix/ea/obsolescence-risk-management-monitor-mitigation?locale=en-US&state=PRODUCTION&version=CLOUD "Monitor risk remediation initiatives and measure progress with reports and dashboard KPI panels. Enhance transparency and engagement through effective and targeted communication.").
