risk acceptance and exceptions