Risk Acceptance Letter Frequently Asked Questions

A Risk Acceptance Letter (RAL) documents situations where certain risks—often related to information security, privacy, or technology—cannot be fully mitigated or eliminated. The letter formally acknowledges these risks and identifies who in the unit accepts responsibility for them.

There are two main types of Risk Acceptance Letters:

• Vendor Risk Acceptance Letters: Issued when working with a vendor or supplier introduces risks that cannot be resolved through contract terms or technical controls.

• Technical Debt Risk Acceptance Letters: Issued when a unit requests an exception to continue using unsupported (end-of-life) software or hardware, or legacy data handling processes.

You’re receiving a Risk Acceptance Letter because your unit is involved in a project, vendor agreement, or technical exception that carries residual risk. The letter ensures that those risks are clearly understood, documented, and formally acknowledged by the appropriate leadership within your unit.

Not all Risk Acceptance Letters indicate a severe problem—many are routine and part of the University’s normal risk management process. A Risk Acceptance Letter does not mean something is unsafe to use or noncompliant; it means there are known risks that cannot be fully addressed and must be acknowledged. If the risks were deemed unacceptable, the project or purchase would not move forward.

Yes. Information Assurance tracks several types of risks, including:

• Vendor-related risks (security or privacy risks in third-party services or systems)

• Technical debt risks (outdated or unsupported technology still in use)

• Procurement or contractual risks (insurance limits, liability, or other business terms)

• IoT and technology risks identified during consultations, such as:

  • Could the device or system be attacked?

  • Could data be lost?

  • Could someone be hurt?

  • Could damage to the device impact research or grants?

Procurement manages the formal process for vendor contracts and ensures that appropriate legal and risk review steps are followed. When a vendor engagement involves unresolved information security or privacy risks, Procurement coordinates with Information Assurance to generate a Risk Acceptance Letter.

The most senior person in the unit is responsible for the risk—often a director or dean—signs the Risk Acceptance Letter. This person accepts ownership of the identified risks on behalf of the unit.

By signing, the unit acknowledges the risks and agrees to proceed knowing those risks exist. It does not mean the risks are ignored—it means they are tracked, monitored, and accepted as part of the decision to move forward.

Once the Risk Acceptance Letter is signed, it’s recorded by Information Assurance (IA) and Procurement for tracking and compliance purposes. The purchase or activity can then proceed, and IA may follow up later if the risk status changes.

Yes. If new information emerges or the risk is later mitigated (for example, by upgrading technology or updating a contract), the Risk Acceptance Letter can be closed, amended, or replaced with an updated version.

No. In fact, the Risk Acceptance Letter allows your unit to move forward despite the risk, with leadership’s awareness and approval.

Not necessarily. Signing a Risk Acceptance Letter means the University acknowledges the residual risk and accepts it. The existence of a Risk Acceptance Letter shows due diligence and transparency—not noncompliance.

Your unit should monitor the situation, report any incidents or changes, and work with IA to reduce or eliminate the risk if circumstances allow (for example, replacing legacy software later).

Yes. IA will annually review Risk Acceptance Letters to confirm whether the risk still exists or has been mitigated. Units may also proactively request a review if they believe the risk has changed.

Yes. Here is a Sample Risk Acceptance Letter that shows the general format and information included.

Once mitigation steps are completed, notify Information Assurance at itrisk@uchicago.edu. They can update or close the Risk Acceptance Letter record to reflect the change and keep documentation current.

If you have questions about the Risk Acceptance Letter or the risks it describes, contact Information Assurance.