The best course of action for the risk practitioner upon learning that the number of failed back-up attempts continually exceeds the current risk threshold is to inquire about the status of any planned corrective actions.
This would help the risk practitioner to understand the root causes of the problem, the progress of the remediation efforts, and the expected timeline for resolution. It would also help the risk practitioner to provide guidance and support to the responsible parties, and to escalate the issue if necessary. Inquiring about the status of any planned corrective actions would demonstrate the risk practitioner's proactive and collaborative approach to riskmanagement, and ensure that the risk exposure is reduced to an acceptable level as soon as possible. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 5, Section
5.2.3, page 2371