CRISC · Question #125
Which risk response strategy could management apply to both positive and negative risk that has been identified?
The correct answer is B. Accept. Accepting a risk, either positive or negative, is a strategy where management acknowledges the risk but decides not to take action, allowing for either the potential gain or loss to occur.
Question
Which risk response strategy could management apply to both positive and negative risk that has been identified?
Options
- ATransfer
- BAccept
- CExploit
- DMitigate
How the community answered
(35 responses)- A6% (2)
- B89% (31)
- C3% (1)
- D3% (1)
Why each option
Accepting a risk, either positive or negative, is a strategy where management acknowledges the risk but decides not to take action, allowing for either the potential gain or loss to occur.
Transferring risk (e.g., through insurance) typically applies to negative risks, shifting the financial burden to a third party.
Risk acceptance is the only strategy among the choices that applies to both positive and negative risks, as it involves making a conscious decision to take no action and simply live with the outcome, whether it's a potential opportunity or a potential threat.
Exploit is a strategy specifically for positive risks (opportunities), aiming to increase the probability or impact of the beneficial outcome.
Mitigate (or treat) is a strategy primarily for negative risks, aiming to reduce the probability or impact of an adverse event.
Concept tested: Risk response strategies for positive and negative risks
Source: https://csrc.nist.gov/publications/detail/sp/800-39/final
Topics
Community Discussion
No community discussion yet for this question.