Senior management is accountable for managing risk within the enterprise, even though it need not receive every instance of non-compliance.

### Why this is right The source states that senior management is ultimately accountable for enterprise risk. It also says that only the most severe risks, as determined by enterprise policy, need to be escalated to that level. ### The concept Governance requires decision-makers to know about material risks, but sending every minor issue to senior management would not be useful. Risk severity and policy guide escalation. Once informed, senior leaders can accept risk as a business decision or ensure that resources for mitigation are available. ### The other options - **False**: this would incorrectly treat accountability as requiring notification of every small instance of non-compliance. ### Terms - **Non-compliance**: failure to meet an applicable requirement. - **Escalation**: raising an issue to a more senior decision-maker. ### Remember Senior leaders need visibility of serious risks, not necessarily every isolated shortfall.