A medium-sized healthcare IT business decides to implement a risk management strategy. Which of the following is NOT one of the five basic responses to risk?

Accept is a valid risk response where an organization consciously decides to live with a risk, typically when mitigation costs outweigh potential losses.

Delegate is not a defined risk response in established risk management frameworks such as NIST SP 800-30 or ISO 31000. The five recognized responses are Accept (tolerate the risk), Avoid (eliminate the risk-causing activity), Transfer (shift risk to a third party via insurance or contracts), Mitigate (reduce likelihood or impact), and sometimes Defer (postpone action). Delegation describes an organizational management task, not a risk treatment strategy.

Mitigate is a valid risk response that involves implementing controls to reduce the probability of a risk occurring or to minimize its impact if it does.

Avoid is a valid risk response where an organization eliminates the source of the risk entirely by discontinuing the activity or process that introduces it.