The issue requires attention by management as an incident or accumulation of incidents are considered possible (not probable) or generally are expected to have only a limited impact on the business. Nevertheless management, subject to other higher risk priorities, should continue to monitor the level of risk and, where necessary, introduce more accelerated risk remediation or mitigation strategies.