CRISC Certified in Risk and Information Systems Control – Question079

Harry is the project manager of HDW project. He has identified a risk that could injure project team members. He does not want to accept any risk where someone could become injured on this project so he hires a professional vendor to complete this portion of the project work. What type of risk response is Harry implementing?

A.
Transference
B. Mitigation
C. Acceptance
D. Avoidance

Correct Answer: A

Explanation:

Explanation:
Risk transfer means that impact of risk is reduced by transferring or otherwise sharing a portion of the risk with an external organization or another internal entity. Transfer of risk can occur in many forms but is most effective when dealing with financial risks. Insurance is one form of risk transfer. Hence when Harry hires a professional vendor to manage that risk, the risk event does not go away but the responsibility for the event is transferred to the vendor.
Incorrect Answers:
B: Risk acceptance means that no action is taken relative to a particular risk; loss is accepted if it occurs. Here Harry is not accepting this risk event; he does not want anyone of his team to become injured so he’s transferring the event to professional vendor.
C: Mitigation are actions that Harry’s project team could take to reduce the probability and/or impact of a risk event.
D: Avoidance removes the risk event entirely either by adding additional steps to avoid the event or reducing the project scope.