The 3-minute threshold is a KRI designed to act as an early warning before a more critical limit (5 minutes) is breached, helping prevent risk realization.
Reference:CRISC Manual - Domain 4, Slide 380-382

Externally sourced policies must be relevant and applicable to the organization's specific operations. Without operational applicability, policies offer little control value-even if they're up-to-date or legally compliant per ISACA practice domains.

If a KRI consistently exceeds thresholds, CRISC instructs thatcorrective action must be initiated, because this indicates sustained elevated risk. Thresholds should not be adjusted simply to match poor performance.
Forward-looking metrics may help but do not address the current issue. Continuing to monitor without taking action allows the risk to remain unaddressed. Engaging the risk owner to initiate mitigation steps is the correct governance response.
Reference:CRISC Review Manual - KRI governance and response thresholds.

The person who should be accountable for resolving the situation where a root cause analysis indicates a major service disruption due to a lack of competency of newly hired IT system administrators is the chief information officer (CIO). The CIO is the senior executive who is responsible for the overall management and governance of the IT function within the organization, including the IT strategy, objectives, policies, processes, and resources. The CIO is also accountable for the performance and value of the IT services and systems, and for ensuring that they meet the needs and expectations of the business and its stakeholders. The CIO should be accountable for resolving the situation, because it involves a major IT service disruption that could affect the organization's operations and reputation, and because it is related to the IT staff competency and capability, which are under the CIO's authority and responsibility. The other options are not as accountable as the CIO, although they may have some roles or involvement in the situation. The HR training director, the business process owner, and the HR recruitment manager are not directly responsible for the IT function or the IT service delivery, and they may not have the authority or the expertise to resolve the situation. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.1.1, page 2-
3.