ITPEC FE Morning April 2021 Question 35
Topic: Security
When risk treatment is classified as risk avoidance, risk reduction, risk acceptance, and risk sharing, which of the following risk treatments is risk avoidance?
Explanation
Discontinuing the operations that carry the risk — avoidance removes the risk by removing the activity it comes from.
The four treatments act on different things:
- •Avoidance: stop the activity, so the risk cannot occur
- •Reduction: apply controls that lower its likelihood or impact
- •Sharing (transfer): move the financial burden to another party
- •Acceptance: knowingly take the risk without further action
Answer (b)
Why not others:
- •(a) — applying controls to lower a risk is risk reduction; the activity goes on
- •(c) — deciding knowingly not to act on a risk is risk acceptance, suited to small risks
- •(d) — transferring a risk to other parties, by insurance or outsourcing, is risk sharing
Key rule: Only avoidance brings a risk to zero, and it does so at the cost of giving up the activity itself.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.