CRISC Certified in Risk and Information Systems Control – Question272

Out of several risk responses, which of the following risk responses is used for negative risk events?

A.
Share
B. Enhance
C. Exploit
D. Accept

Correct Answer: D

Explanation:

Explanation:
Among the given choices only Acceptance response is used for negative risk events. Risk acceptance means that no action is taken relative to a particular risk; loss is accepted if it occurs. If an enterprise adopts a risk acceptance, it should carefully consider who can accept the risk. Risk should be accepted only by senior management in relationship with senior management and the board. There are two alternatives to the acceptance strategy, passive and active.

  • Passive acceptance means that enterprise has made no plan to avoid or mitigate the risk but willing to accept the consequences of the risk.
  • Active acceptance is the second strategy and might include developing contingency plans and reserves to deal with risks.

Incorrect Answers: A, B, C: These all are used to deal with opportunities or positive risks, and not with negative risks.