An organization is most likely to accept the risk of noncompliance with a new regulatory requirement when the cost of complying with the regulation exceeds the potential penalties. This reflects a cost-benefit analysis approach to risk treatment, where the business determines that the financial impact of noncompliance is more acceptable than the cost of implementing compliant controls.
"Risk acceptance occurs when the cost of mitigating or transferring the risk exceeds the benefits of mitigation.
This includes scenarios where the penalties for noncompliance are less than the cost of compliance."
- CISM Review Manual 15th Edition, Chapter 2: Risk Management, Section: Risk Treatment Options* ISACA practice questions consistently highlight that cost-benefit considerations are the driving factor in decisions about accepting the risk of noncompliance.