Topics in this domain
- Risk Response Options: Accept, Mitigate, Transfer, Avoid
- Aligning Responses with Appetite and Tolerance
- Cost-Benefit Analysis of Risk Responses
- Bias in Risk Decisions and Reporting
- Risk Owners and Control Owners
- RACI and Escalation
- Third-Party Risk Governance and Due Diligence
- Contracts, SLAs and the Right to Audit
- Monitoring Third Parties and Planning Exit
- Managing Issues, Findings and Control Deviations
- Risk Acceptance, Exceptions and Exemptions
- Control Frameworks and Their Purpose
- Control Types and Functions
- Designing and Selecting Controls
- Implementing Controls and Why Implementations Fail
- Control Design versus Operating Effectiveness
- Control Testing: Objectives, Evidence and Frequency
- Building and Tracking Risk Action Plans
- Collecting and Aggregating Risk Data
- Validating Risk Data Quality
- KRIs, KPIs and KCIs
- Thresholds, Escalation Triggers and Appetite
- Metric Pitfalls and Misuse
- Continuous Monitoring versus Periodic Assessment
- Tailoring Risk Reports to the Audience
- Heat Maps, Dashboards and Scorecards
- Identifying and Assessing Emerging Risks
- Integrating Emerging Risk into Decisions
Risk Response Options: Accept, Mitigate, Transfer, Avoid
Four responses
Choosing a response
When each fits
| Response | Fits when… |
|---|---|
| Accept | The risk is within appetite, or treatment costs more than it saves |
| Mitigate | Controls reduce the risk cost-effectively |
| Transfer | Financial impact can be shared through insurance or contracts |
| Avoid | The activity’s benefit doesn’t justify its risk |
Responses are often combined. Transfer shares financial impact but never accountability.
Example. A retailer facing payment card breach risk uses a hosted payment page (avoiding storing card data), keeps cyber insurance (transferring some cost) and accepts the small residual risk on its own website.
Who decides
- The practitioner sets out the options, their costs and residual risk.
- The risk owner chooses, within their authority.
- Higher risks escalate to more senior owners.
- The decision is recorded in the register.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who selects the risk response | The risk owner |
| Buying cyber insurance | Transfer; accountability stays with the organisation |
| Stopping a risky service | Avoidance |
| Risk within appetite | Accept and monitor |
In short
- The four responses are accept, mitigate (reduce), transfer (share) and avoid.
- The risk owner chooses the response; the practitioner presents options with costs and residual risk.
- Acceptance must be informed, documented and within the owner's authority.
- Transfer shares financial impact but never accountability.
- Avoidance removes the activity, and its benefits, entirely.
- Responses are often combined; residual risk must end up within appetite.
Exam traps
- Treating mitigation as the only option.
- Thinking insurance transfers accountability or reputational damage.
- Accepting a risk by default because nobody decided.
- The practitioner choosing the response instead of the owner.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Four responses
Choosing a response
1 / 8