In risk management, if the cost of addressing risk is greater than the potential damage, the typical risk posture is called what?

In risk management, if the cost of addressing risk is greater than the potential damage, the typical risk posture is called what?

• A. Mitigation
• B. Acceptance
• C. Avoidance
• D. Transference

Answer: (B)

When evaluating risk responses, you compare the cost of addressing the risk with the potential damage. If implementing controls would cost more than the potential loss, the sensible approach is to accept the risk. This means you acknowledge the risk and continue operations with its residual level rather than spend more to reduce or transfer it. Acceptance is a cost-benefit decision: you tolerate the risk because the value of preventing it exceeds the value of the loss it could cause. Mitigation would try to reduce either the likelihood or impact of the risk, but that requires spending. Avoidance would mean not engaging in the activity at all, which is a much stronger step than simply accepting risk. Transference would shift the risk to another party (for example, through insurance), which isn’t indicated by this scenario since the decision is about whether the cost to address the risk is justified by the potential damage.

When evaluating risk responses, you compare the cost of addressing the risk with the potential damage. If implementing controls would cost more than the potential loss, the sensible approach is to accept the risk. This means you acknowledge the risk and continue operations with its residual level rather than spend more to reduce or transfer it. Acceptance is a cost-benefit decision: you tolerate the risk because the value of preventing it exceeds the value of the loss it could cause.

Mitigation would try to reduce either the likelihood or impact of the risk, but that requires spending. Avoidance would mean not engaging in the activity at all, which is a much stronger step than simply accepting risk. Transference would shift the risk to another party (for example, through insurance), which isn’t indicated by this scenario since the decision is about whether the cost to address the risk is justified by the potential damage.