When a risk assessment shows that the cost of addressing a particular risk is greater than the perceived benefit, the appropriate risk response approach is to accept the risk. Risk acceptance means acknowledging that the risk exists but deciding not to take any action to mitigate it, usually because the cost of mitigation is higher than the potential impact. This approach is a rational decision when the risk is deemed to have a low likelihood or impact, or when other controls are considered sufficient.
References:
* The IIA Standards: Standard 2120 - Risk Management: "The internal audit activity must evaluate the effectiveness and contribute to the improvement of risk management processes."
* COSO ERM Framework: Discusses risk response options including risk acceptance as a viable strategy when the cost-benefit analysis justifies it.