Company XYZ has employed a consultant to perform a controls assessment of the HR system, backend business operations, and the SCADA system used in the factory. Which of the following correctly…

This option mixes inconsistent terminology from different frameworks and does not represent the standard four-option risk treatment taxonomy used in formal controls assessments.

Avoid, transfer, mitigate, and accept are the four universally recognized risk response options codified in frameworks such as NIST SP 800-30 and ISO 31000, and they represent the complete decision set a consultant applies when evaluating each identified risk during a controls assessment. Each option maps directly to a specific management action - eliminating the risk source, shifting liability, reducing likelihood or impact, or consciously accepting exposure. These are the correct and complete options the consultant should use across the HR, business operations, and SCADA assessments.

Risk likelihood, asset value, and threat level are inputs used during the risk analysis phase to calculate risk scores, not the response options used to manage identified risks.

Calculating risk via technical likelihood and business impact describes the risk quantification methodology, not the set of management decisions available after risk has been assessed.