An organization's risk owner formally accepts a residual risk that exceeds the normal acceptance criteria, recording a justification and time-bound review. Under Clauses 8.3 and 6.1.3, is this acceptable during operation?

• A.Yes, residual risk may be retained if formally accepted by the accountable risk owner, with the decision documented
• B.No, residual risk above the criteria may be retained if the certification body approves, with the approval recorded in the audit report
• C.No, residual risk typically must be treated until it meets the criteria, with any exception granted by the auditor in writing
• D.No, a risk owner might accept residual risk if top management countersigns the decision, with the acceptance renewed at each audit