ITPEC FE Subject A April 2026 Question 32

Risk avoidance — the company removes the activity that carries the risk.

By dropping the social media plugin entirely, Company A eliminates the possibility of the privacy leak rather than reducing or absorbing it. That is avoidance by definition.

The four standard responses:

• •Avoidance — stop doing the risky thing
• •Mitigation — keep doing it, but reduce likelihood or impact
• •Sharing — pass part of the loss to someone else, e.g. insurance or outsourcing
• •Acceptance — knowingly bear the risk and do nothing

Answer (b)

Why not others:
- (c) Risk mitigation — would mean shipping the plugin after fixing it so posts respect privacy settings
- (a) Risk acceptance — would mean shipping it unchanged, aware of the flaw
- (d) Risk sharing — would mean transferring the consequences, for example by insuring against privacy claims

Key rule: Ask whether the risky activity still happens. If it is cancelled, that is avoidance; if it continues in a safer form, that is mitigation.

AI-generated — may contain errors