C4.5 Decision record

NASA RIDM [11]; IIA standard 11.5 [18]

The fifth component requires that every response above a stated materiality be recorded in a selection report with the alternatives considered, the tolerance set for each objective affected, the risk of each alternative against those tolerances, the rationale for the choice and the expected exposure that remains; and that a decision to accept a risk whose measured exposure exceeds the appetite position be communicated to the governing body rather than filed in the register. The report is the aerospace handbook's selection report, the closing document of risk-informed decision making [11]. The escalation rule is standard 11.5 of the internal audit standards, which makes acceptance above appetite a communication to the board by the chief audit executive if management has not made it [18].

The component reconciles the committee minute with the engineering decision record. A minute records the outcome and the vote; a selection report records what else could have been done and why it was not, against tolerances that were written before the alternatives were scored. It is the document that makes a response testable afterward: an auditor can confirm that the alternatives existed, that the tolerances were the ones in L1, that the expected exposure written here is the one the register carries, and that the measured exposure in C6.1 was later compared with it. The escalation rule adds the one case where the decision leaves the layer: when the chosen response leaves the organization above its own appetite, the register is not the place where that choice is allowed to live quietly.