3.2 Risk Response Options
Following are the four options for responding to the risk:
Risk Avoidance
In this approach, projects or activities that cause the risk are avoided.
Risk avoidance is the last choice when no other response is adequate.
For example, declining a project when business cases show a high risk of failure.
Risk Mitigation
In this approach efforts are made to reduce the probability or impact of the risk event by designing the appropriate controls.
Objective of risk mitigation is to reduce the risk to an acceptable level.
Risk sharing/Transferring
In this approach, risk is shared with partners or transferred via insurance coverage, contractual agreement or other means.
Natural disasters have a very low probability but a high impact. Response for such risk should be risk transfer.
Risk Acceptance
In this approach, risk is accepted as it is in accordance with risk appetite of the organisation.
Risk is accepted where cost of controlling the risk is more than the cost of risk event.
For example, for few non critical systems, the cost of anti-malware installation is more than the anticipated cost of damage due to malware attack. In such cases, the organization generally accepts the risk as it is.
No steps are taken to reduce the risk.
However, organizations need to be utmost careful while accepting the risk. If risk is accepted without knowing the correct level of risk, it may result in a higher level of liabilities.
Key aspects from CRISC exam perspective
|
CRISC Question
|
Possible
Answer
|
|
Risk response
where cost of control exceeds the cost of risk event
|
Risk
Acceptance
|
|
Risk avoidance
can be done by
|
Exiting the
process that causes the risk
|
|
Risk response
options that most likely to increase the liability
|
Risk
Acceptance
(Organization
may choose to accept risk without knowing the correct level of risk that is
being accepted; this may result in higher liabilities)
|
|
Risk response
in which process is outsourced to a professional organization having
expertise knowledge
|
Risk
Mitigation
|
|
Most suitable
risk response where risk related to a specific business process is greater
than the potential opportunity
|
Risk Avoidance
|
|
Risk response
in form of purchasing an insurance is
|
Risk transfer
|
|
Use
of a business case
|
Business
case helps to determine the costs and benefits of the risk response.
|
|
Most
important for risk mitigation to
|
Is
to reduce the risk to an acceptable level
|
|
Most effective way to treat a risk with a low
probability and a high impact (such as natural disaster)
|
Risk
Transfer
|