Certified Risk and Information Systems Control Exam - CRISC: Risk Response Type

Risk Response Type

Prev Question Next Question

Question

David is the project manager of the HRC Project.

He has identified a risk in the project, which could cause the delay in the project.

David does not want this risk event to happen so he takes few actions to ensure that the risk event will not happen.

These extra steps, however, cost the project an additional $10,000

What type of risk response has David adopted?

Answers

Explanations

Click on the arrows to vote for the correct answer

A. B. C. D.

B.

As David is taking some operational controls to reduce the likelihood and impact of the risk, hence he is adopting risk mitigation.

Risk mitigation means that actions are taken to reduce the likelihood and/or impact of risk.

Incorrect Answers: A: Risk avoidance means that activities or conditions that give rise to risk are discontinued.

But here, no such actions are taken, therefore risk in not avoided.

C: Risk acceptance means that no action is taken relative to a particular risk; loss is accepted in case it occurs.

As David has taken some actions in case to defend, therefore he is not accepting risk.

D: David has not hired a vendor to manage the risk for his project; therefore he is not transferring the risk.

Based on the scenario described, David has identified a risk that could potentially cause a delay in the HRC project. To avoid this risk event, he has taken additional actions, which have resulted in an additional cost of $10,000.

The four types of risk response strategies are:

A. Avoidance - This strategy involves eliminating the risk event by changing the project plan or avoiding certain activities that could cause the risk to occur.

B. Mitigation - This strategy involves reducing the impact or probability of the risk event occurring by taking proactive measures such as increasing communication, implementing contingency plans, or adding extra resources.

C. Acceptance - This strategy involves acknowledging the risk event and its potential impact but choosing not to take any additional action to mitigate it.

D. Transfer - This strategy involves shifting the risk event to another party such as an insurance company, vendor, or third-party service provider.

In the given scenario, David has taken steps to reduce the impact or probability of the risk event occurring, which falls under the mitigation strategy. He has not eliminated the risk entirely, but he has taken proactive measures to reduce the likelihood of the risk event occurring. Additionally, the cost of these actions reflects the expense of implementing the mitigation strategy.

Therefore, the correct answer is B. Mitigation.