CRISC Risk Response and Mitigation Practice Question
A healthcare organization is required by law to retain patient records for seven years. The IT department proposes storing backups on tapes that are kept in an on-site vault. The risk manager notes that the on-site vault is in a flood zone. Which risk response strategy is being applied if the organization decides to move the tapes to a secure off-site facility in a different geographic region?
⚠ Common exam trap
Candidates often confuse mitigation with avoidance; moving data to a safer location reduces risk but does not eliminate the activity that creates the risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk mitigation
The correct answer is risk mitigation. By moving backups to an off-site facility, the organization implements a control that reduces the risk of flood damage. This is a classic example of mitigation, where the goal is to lower the probability or impact of a threat, rather than avoiding the activity or transferring the risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Risk mitigation
Why this is correct
Moving backups to an off-site facility in a different geographic region reduces the risk of loss from a flood. This is a mitigation strategy because it implements a control (geographic separation) to lower the likelihood or impact of a disaster. The organization still retains records but with reduced risk.
- ✗
Risk acceptance
Why it's wrong here
Risk acceptance would mean acknowledging the risk and taking no action. The organization is actively changing the storage location to reduce risk, so acceptance does not apply. Acceptance is typically a conscious decision to retain risk without additional controls.
- ✗
Risk transfer
Why it's wrong here
Risk transfer involves shifting the financial impact to a third party, such as through insurance. Here, the organization is not transferring the risk; it is taking direct action to reduce the risk by relocating backups. The risk of record loss remains with the organization.
- ✗
Risk avoidance
Why it's wrong here
Risk avoidance would mean eliminating the activity that creates the risk, such as not retaining records at all. However, the organization must retain records by law, so avoidance is not possible. Moving backups to an off-site facility does not avoid the risk but reduces it.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.