CRISC Risk Response and Mitigation Practice Question
A financial services firm has identified that its primary data center is located in a region prone to hurricanes. The risk manager proposes purchasing business interruption insurance to cover potential losses from a catastrophic event. Which risk response strategy does this represent?
⚠ Common exam trap
A common mix-up: candidates confuse risk transfer with risk mitigation, assuming that buying insurance reduces the risk itself rather than just its financial consequences.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk transfer
Purchasing insurance is a classic example of risk transfer, where the financial impact of a risk is shifted to an insurance provider. The risk event (hurricane) still occurs, but the firm is compensated for losses, protecting its financial stability. This strategy is appropriate when the risk is high-impact but low-frequency, and the cost of insurance is justified.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk avoidance
Why it's wrong here
Risk avoidance involves eliminating the activity or condition that gives rise to the risk. Purchasing insurance does not eliminate the hurricane risk or the data center's location; it merely transfers the financial impact. Avoidance would require relocating the data center entirely or ceasing operations in that region, which is not what the scenario describes.
- ✗
Risk acceptance
Why it's wrong here
Risk acceptance means acknowledging the risk and deciding to bear the consequences without taking further action. Purchasing insurance is an active step to shift financial responsibility, not passive acceptance. Acceptance would involve setting aside contingency funds or simply acknowledging the risk without insurance, which is not the case here.
- ✓
Risk transfer
Why this is correct
Risk transfer shifts the financial consequences of a risk to a third party, typically through insurance or outsourcing. By purchasing business interruption insurance, the firm transfers the financial loss from a hurricane to the insurer. The risk itself remains, but the financial impact is borne by another party, making this the correct classification.
- ✗
Risk mitigation
Why it's wrong here
Risk mitigation reduces the likelihood or impact of a risk through controls such as backups, redundant systems, or physical hardening. Insurance does not reduce the probability of a hurricane or the physical damage; it only compensates for financial loss after the event. Therefore, this is not a mitigation strategy.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.