ITPEC IP October 2025 Question 39
In risk management for information security, the categories that include risk transfer, risk avoidance, risk mitigation, and risk retention are sometimes used. Which of the following is the appropriate description concerning these?
Explanation
Buying insurance is risk transfer, a category of risk treatment — the four categories classify ways of treating a risk.
Risk management first assesses risks (identification, analysis, evaluation) and then treats them. The four categories are the choices at the treatment stage:
- •Risk avoidance — stop the activity that carries the risk
- •Risk mitigation — take measures that lower the likelihood or the damage
- •Risk transfer — pass the loss to a third party by contract, such as an insurer or an outsourcing partner
- •Risk retention — knowingly accept a small risk without special measures
Insurance does not stop the incident but moves its financial loss to the insurer, so (a) is right on both counts: the stage and the example.
Answer (a)
Why not others:
- •(b) — risk identification finds assets, threats and vulnerabilities; mitigation is a way of treating a risk, not a class of asset by purpose of use
- •(c) — risk evaluation compares analysed risk levels with acceptance criteria; avoidance is a treatment, not an evaluation methodology
- •(d) — quantifying vulnerabilities is part of risk analysis; retention means accepting a risk, not a method of analysis
Key rule: Identification, analysis and evaluation make up risk assessment; avoidance, mitigation, transfer and retention are the options of the next stage, risk treatment.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.